{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T16:36:37.390099Z","repo":{"ref":{"host":"github.com","owner":"Mintplex-Labs","name":"anything-llm"},"default_branch":"master","clone_url":"https://github.com/Mintplex-Labs/anything-llm.git","html_url":"https://github.com/Mintplex-Labs/anything-llm","description":"Stop renting your intelligence. Own it with AnythingLLM. Everything you need for a powerful local-first agent experience ","stars":68276,"forks":7706,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":96797,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2023-06-04T02:29:14Z","pushed_at":"2026-11-13T22:55:56Z","security_policy_url":"https://github.com/Mintplex-Labs/anything-llm/security/policy","distribution":{"owner_created_at":"2023-05-23T16:32:22Z","owner_type":"Organization","release_assets":[{"name":"AnythingLLMDesktop-Arm64.AppImage","size":633799570,"download_count":332,"release_tag":"v1.19.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":501534408,"download_count":485,"release_tag":"v1.19.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":584275091,"download_count":1100,"release_tag":"v1.19.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":905441828,"download_count":1496,"release_tag":"v1.19.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":550006618,"download_count":343,"release_tag":"v1.19.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":403299096,"download_count":9731,"release_tag":"v1.19.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop.exe"},{"name":"installer.sh","size":23552,"download_count":161,"release_tag":"v1.19.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/installer.sh"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":632226083,"download_count":296,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":513734624,"download_count":293,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":582631265,"download_count":685,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":903867816,"download_count":1189,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":548548002,"download_count":162,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":407381240,"download_count":5297,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/AnythingLLMDesktop.exe"},{"name":"installer.sh","size":23552,"download_count":167,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/installer.sh"},{"name":"version.txt","size":6,"download_count":417,"release_tag":"v1.18.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.18.0/version.txt"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":631938379,"download_count":318,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":521652408,"download_count":377,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":566665700,"download_count":515,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":903580827,"download_count":932,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":531987496,"download_count":254,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":410136032,"download_count":4547,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/AnythingLLMDesktop.exe"},{"name":"installer.sh","size":11669,"download_count":154,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/installer.sh"},{"name":"version.txt","size":6,"download_count":403,"release_tag":"v1.17.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.17.0/version.txt"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":631749078,"download_count":189,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":520814592,"download_count":238,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":566063097,"download_count":338,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":903387826,"download_count":638,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":532011890,"download_count":120,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":410276472,"download_count":2914,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/AnythingLLMDesktop.exe"},{"name":"installer.sh","size":11669,"download_count":138,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/installer.sh"},{"name":"version.txt","size":6,"download_count":429,"release_tag":"v1.16.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.2/version.txt"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":631052881,"download_count":323,"release_tag":"v1.16.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.1/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":521403672,"download_count":555,"release_tag":"v1.16.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.1/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":547603907,"download_count":729,"release_tag":"v1.16.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.1/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":902698392,"download_count":1459,"release_tag":"v1.16.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.1/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":513697075,"download_count":250,"release_tag":"v1.16.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.1/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":410516264,"download_count":11395,"release_tag":"v1.16.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.1/AnythingLLMDesktop.exe"},{"name":"installer.sh","size":11669,"download_count":303,"release_tag":"v1.16.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.1/installer.sh"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":556480535,"download_count":207,"release_tag":"v1.16.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.0/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":543081424,"download_count":327,"release_tag":"v1.16.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.0/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":506752783,"download_count":840,"release_tag":"v1.16.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.0/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":577247582,"download_count":830,"release_tag":"v1.16.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.0/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":513222878,"download_count":151,"release_tag":"v1.16.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.0/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":396070296,"download_count":5566,"release_tag":"v1.16.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.16.0/AnythingLLMDesktop.exe"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":554451319,"download_count":545,"release_tag":"v1.15.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.15.0/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":541454816,"download_count":781,"release_tag":"v1.15.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.15.0/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":504479476,"download_count":1229,"release_tag":"v1.15.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.15.0/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":575209884,"download_count":2157,"release_tag":"v1.15.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.15.0/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":511074980,"download_count":376,"release_tag":"v1.15.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.15.0/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":394525080,"download_count":17493,"release_tag":"v1.15.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.15.0/AnythingLLMDesktop.exe"},{"name":"installer.sh","size":11669,"download_count":482,"release_tag":"v1.15.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.15.0/installer.sh"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":543322129,"download_count":53,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":530822448,"download_count":100,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":490702576,"download_count":85,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":564085323,"download_count":129,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":500232755,"download_count":62,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":377062032,"download_count":750,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/AnythingLLMDesktop.exe"},{"name":"installer.sh","size":11669,"download_count":118,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/installer.sh"},{"name":"version.txt","size":6,"download_count":240,"release_tag":"v1.14.2","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.2/version.txt"},{"name":"AnythingLLMDesktop-Arm64.AppImage","size":544065136,"download_count":228,"release_tag":"v1.14.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.1/AnythingLLMDesktop-Arm64.AppImage"},{"name":"AnythingLLMDesktop-Arm64.exe","size":530734144,"download_count":213,"release_tag":"v1.14.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.1/AnythingLLMDesktop-Arm64.exe"},{"name":"AnythingLLMDesktop-Silicon.dmg","size":494924122,"download_count":231,"release_tag":"v1.14.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.1/AnythingLLMDesktop-Silicon.dmg"},{"name":"AnythingLLMDesktop.AppImage","size":564827257,"download_count":444,"release_tag":"v1.14.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.1/AnythingLLMDesktop.AppImage"},{"name":"AnythingLLMDesktop.dmg","size":501079159,"download_count":105,"release_tag":"v1.14.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.1/AnythingLLMDesktop.dmg"},{"name":"AnythingLLMDesktop.exe","size":387908696,"download_count":1906,"release_tag":"v1.14.1","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.1/AnythingLLMDesktop.exe"},{"name":"AnythingLLMDesktop.exe","size":392265904,"download_count":496,"release_tag":"v1.14.0","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.14.0/AnythingLLMDesktop.exe"}]}},"commit_sha":"4d09fa5f730698d39f1d783e47316744b260a700","profile":{"lines_by_language":{"JavaScript":303503,"SQL":574,"Shell":82,"HCL":56},"files_by_category":{"source":1241,"binary":128,"test":100,"config":83,"docs":36,"other":27,"generated":3,"vendored":2},"source_lines":276822,"test_lines":27393},"pillars":{"ai_provenance":{"score":0.9,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0088,"suspected_share":0.0466,"estimated_share":0.0088,"ai_artifacts":0.0,"flagged_work_units":7.0,"flagged_releases":0.0,"style_index":0.112},"summary":"Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals."},"quality":{"score":60.7,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":62.1,"duplication":35.7,"lint":38.9,"testing":79.9,"docs":80.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.10, CI runs tests; 16% of function code in complex or long functions; 17% duplicated lines. Weakest area: duplication."},"security":{"score":52.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":85.1,"dependencies":0.0,"ci_actions":0.1,"posture":60.0,"scorecard":null},"summary":"Security posture is weak: 503 known vulnerabilities in 131 dependencies; 8 high-severity SAST findings; 36 high-severity workflow issues. Weakest area: dependencies."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":161.0,"checked":161.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":2558.0,"attributed_commits":21.0,"attributed_commit_share":0.008209538702111024,"effective_loc":455254.0,"attributed_loc":3996.0,"attributed_loc_share":0.00877751760555646,"tools_detected":4.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 10 attributed commits, 2,562 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 9 attributed commits, 1,100 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Devin: 1 attributed commits, 2 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 1 attributed commits, 332 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"93623daa776cfbcc5a72161e129295aae8c95860","url":"https://github.com/Mintplex-Labs/anything-llm/commit/93623daa776cfbcc5a72161e129295aae8c95860","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"4949328c452993fa7bc763d8f77d6176a4855013","url":"https://github.com/Mintplex-Labs/anything-llm/commit/4949328c452993fa7bc763d8f77d6176a4855013","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-cancel-queued-scheduled-jobs'","ref":"ce48dbaa95d9462d7da096345f8ef2524fbb50b5","url":"https://github.com/Mintplex-Labs/anything-llm/commit/ce48dbaa95d9462d7da096345f8ef2524fbb50b5","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-pgvector-rollback'","ref":"2749f98ddb57e9c5202e224150d43a70c546e9f7","url":"https://github.com/Mintplex-Labs/anything-llm/commit/2749f98ddb57e9c5202e224150d43a70c546e9f7","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-anthropic-serial-tools'","ref":"7f5e2b5ce35b9e29cd5ba7bb4aa43016e1b63389","url":"https://github.com/Mintplex-Labs/anything-llm/commit/7f5e2b5ce35b9e29cd5ba7bb4aa43016e1b63389","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"d5b7c87f3f05f06dd2ff8c976ffcd0be6f499888","url":"https://github.com/Mintplex-Labs/anything-llm/commit/d5b7c87f3f05f06dd2ff8c976ffcd0be6f499888","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"c09759673fa34ab430db76740d9a8b8e61195692","url":"https://github.com/Mintplex-Labs/anything-llm/commit/c09759673fa34ab430db76740d9a8b8e61195692","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-generic-openai-agent-max-tokens'","ref":"effcf539e70c10d0bb37d61e66ca2cd6a3ed8499","url":"https://github.com/Mintplex-Labs/anything-llm/commit/effcf539e70c10d0bb37d61e66ca2cd6a3ed8499","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/enforce-workspace-memory-limit'","ref":"29713f29f6cc2a7bc611a4b8fcc97e6bd433a16c","url":"https://github.com/Mintplex-Labs/anything-llm/commit/29713f29f6cc2a7bc611a4b8fcc97e6bd433a16c","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"88e19b6df19d2578337c64faba92b0056cffdec8","url":"https://github.com/Mintplex-Labs/anything-llm/commit/88e19b6df19d2578337c64faba92b0056cffdec8","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-zh-tw-scheduled-jobs'","ref":"6550b8c5f801a05990e241fe8daab27195edddab","url":"https://github.com/Mintplex-Labs/anything-llm/commit/6550b8c5f801a05990e241fe8daab27195edddab","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/add-datetime-prompt'","ref":"24004334b3d48f51af12816c9d46943043a3ab4a","url":"https://github.com/Mintplex-Labs/anything-llm/commit/24004334b3d48f51af12816c9d46943043a3ab4a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a9e3c0585fc9e0909f6035b7ddcfc5950bd68f1c","url":"https://github.com/Mintplex-Labs/anything-llm/commit/a9e3c0585fc9e0909f6035b7ddcfc5950bd68f1c","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/terms-wording-20260601'","ref":"7c1e55c1d0c77524026af22288b2745cbeb7ff3e","url":"https://github.com/Mintplex-Labs/anything-llm/commit/7c1e55c1d0c77524026af22288b2745cbeb7ff3e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"7d884c7863c4ffc7709a2c082f4875e1ab74aa98","url":"https://github.com/Mintplex-Labs/anything-llm/commit/7d884c7863c4ffc7709a2c082f4875e1ab74aa98","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/add-baidu-search-provider'","ref":"680d38a3ce914537738b0b406e056045da2af7b6","url":"https://github.com/Mintplex-Labs/anything-llm/commit/680d38a3ce914537738b0b406e056045da2af7b6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9d242bc053cb9f4c42d1ac724e86a3f2bbd31d8d","url":"https://github.com/Mintplex-Labs/anything-llm/commit/9d242bc053cb9f4c42d1ac724e86a3f2bbd31d8d","weight":0.9},{"kind":"attributed-commit","description":"Devin: trailer 'Co-authored-by: Devin'","ref":"d79e5d7527dd27ff8db431c25d8287b2fa4d1304","url":"https://github.com/Mintplex-Labs/anything-llm/commit/d79e5d7527dd27ff8db431c25d8287b2fa4d1304","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"409ac543bd2f43b4784ec28b4ef22878a6259ccc","url":"https://github.com/Mintplex-Labs/anything-llm/commit/409ac543bd2f43b4784ec28b4ef22878a6259ccc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4cd3c778939d8461a551a96cf9df887da0e33c09","url":"https://github.com/Mintplex-Labs/anything-llm/commit/4cd3c778939d8461a551a96cf9df887da0e33c09","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1ccf46815809d0765cc35e9696dc983fb4e388db","url":"https://github.com/Mintplex-Labs/anything-llm/commit/1ccf46815809d0765cc35e9696dc983fb4e388db","weight":0.9}],"data":{"attributed_loc_by_commit":{"1ccf46815809d0765cc35e9696dc983fb4e388db":29,"4cd3c778939d8461a551a96cf9df887da0e33c09":87,"409ac543bd2f43b4784ec28b4ef22878a6259ccc":131,"d79e5d7527dd27ff8db431c25d8287b2fa4d1304":2,"9d242bc053cb9f4c42d1ac724e86a3f2bbd31d8d":8,"680d38a3ce914537738b0b406e056045da2af7b6":163,"7d884c7863c4ffc7709a2c082f4875e1ab74aa98":96,"7c1e55c1d0c77524026af22288b2745cbeb7ff3e":0,"a9e3c0585fc9e0909f6035b7ddcfc5950bd68f1c":1,"24004334b3d48f51af12816c9d46943043a3ab4a":51,"6550b8c5f801a05990e241fe8daab27195edddab":55,"88e19b6df19d2578337c64faba92b0056cffdec8":332,"29713f29f6cc2a7bc611a4b8fcc97e6bd433a16c":627,"effcf539e70c10d0bb37d61e66ca2cd6a3ed8499":135,"c09759673fa34ab430db76740d9a8b8e61195692":86,"d5b7c87f3f05f06dd2ff8c976ffcd0be6f499888":84,"7f5e2b5ce35b9e29cd5ba7bb4aa43016e1b63389":16,"2749f98ddb57e9c5202e224150d43a70c546e9f7":6,"ce48dbaa95d9462d7da096345f8ef2524fbb50b5":47,"4949328c452993fa7bc763d8f77d6176a4855013":4,"93623daa776cfbcc5a72161e129295aae8c95860":2036},"tools":{"claude-code":{"name":"Claude Code","commits":10,"loc":2562,"first_seen":1770936035,"last_seen":1792443499},"devin":{"name":"Devin","commits":1,"loc":2,"first_seen":1773856236,"last_seen":1773856236},"openai-codex":{"name":"OpenAI Codex","commits":9,"loc":1100,"first_seen":1776905600,"last_seen":1791835936},"cursor":{"name":"Cursor agent","commits":1,"loc":332,"first_seen":1787081209,"last_seen":1787081209}},"monthly":{"2023-06":{"loc":10072,"attributed_loc":0},"2023-07":{"loc":6498,"attributed_loc":0},"2023-08":{"loc":6642,"attributed_loc":0},"2023-09":{"loc":1915,"attributed_loc":0},"2023-10":{"loc":6954,"attributed_loc":0},"2023-11":{"loc":4767,"attributed_loc":0},"2023-12":{"loc":5596,"attributed_loc":0},"2024-01":{"loc":8530,"attributed_loc":0},"2024-02":{"loc":14028,"attributed_loc":0},"2024-03":{"loc":3724,"attributed_loc":0},"2024-04":{"loc":14653,"attributed_loc":0},"2024-05":{"loc":9092,"attributed_loc":0},"2024-06":{"loc":11497,"attributed_loc":0},"2024-07":{"loc":9040,"attributed_loc":0},"2024-08":{"loc":7155,"attributed_loc":0},"2024-09":{"loc":3775,"attributed_loc":0},"2024-10":{"loc":3505,"attributed_loc":0},"2024-11":{"loc":9937,"attributed_loc":0},"2024-12":{"loc":3795,"attributed_loc":0},"2025-01":{"loc":3412,"attributed_loc":0},"2025-02":{"loc":12011,"attributed_loc":0},"2025-03":{"loc":22440,"attributed_loc":0},"2025-04":{"loc":8666,"attributed_loc":0},"2025-05":{"loc":8896,"attributed_loc":0},"2025-06":{"loc":7610,"attributed_loc":0},"2025-07":{"loc":6444,"attributed_loc":0},"2025-08":{"loc":5028,"attributed_loc":0},"2025-09":{"loc":2531,"attributed_loc":0},"2025-10":{"loc":5118,"attributed_loc":0},"2025-11":{"loc":4328,"attributed_loc":0},"2025-12":{"loc":3402,"attributed_loc":0},"2026-01":{"loc":13067,"attributed_loc":0},"2026-02":{"loc":6056,"attributed_loc":29},"2026-03":{"loc":31709,"attributed_loc":228},"2026-04":{"loc":38969,"attributed_loc":163},"2026-05":{"loc":17878,"attributed_loc":96},"2026-06":{"loc":9679,"attributed_loc":1},"2026-07":{"loc":25961,"attributed_loc":51},"2026-08":{"loc":24885,"attributed_loc":1014},"2026-09":{"loc":16081,"attributed_loc":305},"2026-10":{"loc":21937,"attributed_loc":2109},"2026-11":{"loc":17971,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":2005.0,"flagged_units":7.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":360475.0,"flagged_loc":21232.0,"flagged_loc_share":0.05890006241764339,"max_loc_per_hour":4284.0,"median_loc_per_hour":22.296853842900767,"pr_timed_units":1611.0,"excluded_import_loc":94779.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,142 lines of first-party code in ~0.5h (4,284 lines/hour, PR #1923)","ref":"f8e54b232810e2b40fa960fda685fffe7cf4b33d","url":"https://github.com/Mintplex-Labs/anything-llm/commit/f8e54b232810e2b40fa960fda685fffe7cf4b33d","weight":0.6},{"kind":"velocity-burst","description":"1,471 lines of first-party code in ~0.5h (2,855 lines/hour, PR #3678)","ref":"451f4c266e4ddc9619d7d18607a758b029ce731b","url":"https://github.com/Mintplex-Labs/anything-llm/commit/451f4c266e4ddc9619d7d18607a758b029ce731b","weight":0.6},{"kind":"velocity-burst","description":"9,547 lines of first-party code in ~4.0h (2,387 lines/hour, 1 commit session)","ref":"c29f7669c4f60cdb153479338edd3d6570529a40","url":"https://github.com/Mintplex-Labs/anything-llm/commit/c29f7669c4f60cdb153479338edd3d6570529a40","weight":0.6},{"kind":"velocity-burst","description":"1,171 lines of first-party code in ~0.5h (2,342 lines/hour, PR #5783)","ref":"a4c9ee1bafa0b1c02338ec4e5fd982a871e4d654","url":"https://github.com/Mintplex-Labs/anything-llm/commit/a4c9ee1bafa0b1c02338ec4e5fd982a871e4d654","weight":0.6},{"kind":"velocity-burst","description":"1,103 lines of first-party code in ~0.5h (2,206 lines/hour, PR #4100)","ref":"e13d06c43059ec3d61f19d755a9c85d833060678","url":"https://github.com/Mintplex-Labs/anything-llm/commit/e13d06c43059ec3d61f19d755a9c85d833060678","weight":0.6},{"kind":"velocity-burst","description":"4,238 lines of first-party code in ~4.1h (1,035 lines/hour, PR #4907)","ref":"cd5530de396bcce697b96f35d2d0781c327730e0","url":"https://github.com/Mintplex-Labs/anything-llm/commit/cd5530de396bcce697b96f35d2d0781c327730e0","weight":0.31056045596417425},{"kind":"velocity-burst","description":"1,560 lines of first-party code in ~2.5h (613 lines/hour, PR #3699)","ref":"21ffabfb15df63cb0af625cb4200e382df1837be","url":"https://github.com/Mintplex-Labs/anything-llm/commit/21ffabfb15df63cb0af625cb4200e382df1837be","weight":0.18378968037525906}],"data":{"flagged_loc_by_commit":{"f8e54b232810e2b40fa960fda685fffe7cf4b33d":2142,"c29f7669c4f60cdb153479338edd3d6570529a40":9547,"451f4c266e4ddc9619d7d18607a758b029ce731b":1471,"21ffabfb15df63cb0af625cb4200e382df1837be":1560,"e13d06c43059ec3d61f19d755a9c85d833060678":1103,"cd5530de396bcce697b96f35d2d0781c327730e0":4238,"a4c9ee1bafa0b1c02338ec4e5fd982a871e4d654":1171},"excluded_import_commits":["1846a99b93939588b8d8d2a4a01eebbd109d3261","192ca411f261296cc503d1a8353450839a458fc1","1c0d0301b09ecbd742521f7ae7d46056fab126ac","1cea4df8e62ec77b03e56e3cacebc7b450e0ae31","27c58541bd555b8b9791ed6e2d8d7bdb252230ca","3dedcede34721b041de7cb33ba254a0ad1cecbb6","41495cdabe1de79b9e471cc154987bcfe9b83a48","41727518584491baabf50e10da35f6006be55dfd","4e324105bb9d3b3bd73aded669e0a9e81e26dc9f","6dbec6fde6156d099323cf39f8459f906172ba89","708068a09e1817e493a1f186567c198aebbaa27b","7aaea7f5143e048de7d79e034eaca76ed7c8c230","91f5f94200e3eb7ca808e9e8098594fec52b3d8a","a5bb77f97aed3ed6d0ec114f49d62c88e291cc6d","cec67d77f2779b184be9cd74a468fcd7da1b6f70"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":38.0,"flagged_releases":0.0,"max_loc_per_day":2781.4},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0.0","to":"v1.1.0","loc":1543,"days":5.06,"loc_per_day":305.2,"flagged":false},{"from":"v1.1.0","to":"v1.1.1","loc":1065,"days":2.11,"loc_per_day":505.9,"flagged":false},{"from":"v1.1.1","to":"v1.2.0","loc":1986,"days":4.99,"loc_per_day":398.1,"flagged":false},{"from":"v1.2.0","to":"v1.2.1","loc":1843,"days":11.91,"loc_per_day":154.7,"flagged":false},{"from":"v1.2.1","to":"v1.2.2","loc":3374,"days":23.04,"loc_per_day":146.5,"flagged":false},{"from":"v1.2.2","to":"v1.2.3","loc":2909,"days":22.02,"loc_per_day":132.1,"flagged":false},{"from":"v1.2.3","to":"v1.2.4","loc":2649,"days":21.06,"loc_per_day":125.8,"flagged":false},{"from":"v1.2.4","to":"v1.3.0","loc":10546,"days":32.9,"loc_per_day":320.5,"flagged":false},{"from":"v1.3.0","to":"v1.4.0","loc":6791,"days":64.01,"loc_per_day":106.1,"flagged":false},{"from":"v1.4.0","to":"v1.7.4","loc":6549,"days":19.11,"loc_per_day":342.7,"flagged":false},{"from":"v1.7.4","to":"v1.7.5","loc":5890,"days":14.77,"loc_per_day":398.9,"flagged":false},{"from":"v1.7.5","to":"v1.7.6","loc":1148,"days":15.06,"loc_per_day":76.2,"flagged":false},{"from":"v1.7.6","to":"v1.7.8","loc":19769,"days":7.11,"loc_per_day":2781.4,"flagged":false},{"from":"v1.7.8","to":"v1.8.0","loc":6333,"days":23.01,"loc_per_day":275.3,"flagged":false},{"from":"v1.8.0","to":"v1.8.1","loc":4546,"days":17.03,"loc_per_day":267.0,"flagged":false},{"from":"v1.8.1","to":"v1.8.2","loc":10736,"days":35.77,"loc_per_day":300.2,"flagged":false},{"from":"v1.8.2","to":"v1.8.3","loc":7131,"days":29.12,"loc_per_day":244.9,"flagged":false},{"from":"v1.8.3","to":"v1.8.4","loc":1363,"days":6.93,"loc_per_day":196.6,"flagged":false},{"from":"v1.8.4","to":"v1.8.5","loc":8011,"days":29.13,"loc_per_day":275.1,"flagged":false},{"from":"v1.8.5","to":"v1.9.0","loc":6769,"days":56.06,"loc_per_day":120.7,"flagged":false},{"from":"v1.9.0","to":"v1.9.1","loc":6702,"days":56.97,"loc_per_day":117.6,"flagged":false},{"from":"v1.9.1","to":"v1.10.0","loc":6412,"days":47.11,"loc_per_day":136.1,"flagged":false},{"from":"v1.10.0","to":"v1.11.0","loc":9842,"days":27.69,"loc_per_day":355.4,"flagged":false},{"from":"v1.11.0","to":"v1.11.1","loc":4812,"days":12.03,"loc_per_day":400.1,"flagged":false},{"from":"v1.11.1","to":"v1.11.2","loc":7176,"days":15.96,"loc_per_day":449.7,"flagged":false},{"from":"v1.11.2","to":"v1.12.0","loc":6921,"days":15.18,"loc_per_day":455.8,"flagged":false},{"from":"v1.12.0","to":"v1.12.1","loc":4922,"days":20.06,"loc_per_day":245.4,"flagged":false},{"from":"v1.12.1","to":"v1.13.0","loc":9555,"days":33.87,"loc_per_day":282.1,"flagged":false},{"from":"v1.13.0","to":"v1.14.0","loc":5351,"days":13.78,"loc_per_day":388.3,"flagged":false},{"from":"v1.14.0","to":"v1.14.1","loc":1857,"days":7.31,"loc_per_day":254.1,"flagged":false},{"from":"v1.14.1","to":"v1.14.2","loc":1158,"days":5.98,"loc_per_day":193.5,"flagged":false},{"from":"v1.14.2","to":"v1.15.0","loc":172,"days":3.1,"loc_per_day":55.4,"flagged":false},{"from":"v1.15.0","to":"v1.16.0","loc":24799,"days":48.93,"loc_per_day":506.9,"flagged":false},{"from":"v1.16.0","to":"v1.16.1","loc":8671,"days":13.78,"loc_per_day":629.1,"flagged":false},{"from":"v1.16.1","to":"v1.16.2","loc":18546,"days":26.11,"loc_per_day":710.4,"flagged":false},{"from":"v1.16.2","to":"v1.17.0","loc":10487,"days":9.14,"loc_per_day":1147.3,"flagged":false},{"from":"v1.17.0","to":"v1.18.0","loc":1787,"days":11.02,"loc_per_day":162.2,"flagged":false},{"from":"v1.18.0","to":"v1.19.0","loc":13113,"days":12.82,"loc_per_day":1022.7,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":276822.0,"index":0.112,"count:narrated_steps":6.0,"per_kloc:narrated_steps":0.022,"files:narrated_steps":3.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":50.0,"per_kloc:emoji_in_code":0.181,"files:emoji_in_code":25.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Calculated rules (always re-evaluated, they're instant)","ref":"server/utils/AiProviders/modelRouter/index.js:57","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/AiProviders/modelRouter/index.js#L57","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: LLM rules (cached to avoid expensive re-classification)","ref":"server/utils/AiProviders/modelRouter/index.js:73","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/AiProviders/modelRouter/index.js#L73","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: No rule matched — check sticky route","ref":"server/utils/AiProviders/modelRouter/index.js:93","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/AiProviders/modelRouter/index.js#L93","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 4: Sticky expired — use fallback","ref":"server/utils/AiProviders/modelRouter/index.js:108","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/AiProviders/modelRouter/index.js#L108","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, fallback to the workspace chat provider and model if they exist","ref":"server/utils/agents/ephemeral.js:164","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/agents/ephemeral.js#L164","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, fallback to the workspace chat provider and model if they exist","ref":"server/utils/agents/index.js:435","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/agents/index.js#L435","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"server/utils/vectorDbProviders/pinecone/PINECONE_SETUP.md","line":22,"fingerprint":"server/utils/vectorDbProviders/pinecone/PINECONE_SETUP.md:generic-api-key:22"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":599.0,"findings_high":8.0,"findings_medium":442.0,"findings_low":149.0,"weighted_findings":127.562,"scanned_lines":276248.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `pathToTest`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"collector/utils/WhisperProviders/ffmpeg/index.js","line":65,"fingerprint":"javascript.lang.security.detect-child-process:collector/utils/WhisperProviders/ffmpeg/index.js:65"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"frontend/src/components/WorkspaceChat/index.jsx","line":200,"fingerprint":"javascript.browser.security.insecure-document-method:frontend/src/components/WorkspaceChat/index.jsx:200"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `target.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"frontend/src/components/WorkspaceChat/index.jsx","line":200,"fingerprint":"javascript.browser.security.insecure-innerhtml:frontend/src/components/WorkspaceChat/index.jsx:200"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"server/swagger/index.js","line":24,"fingerprint":"javascript.browser.security.insecure-document-method:server/swagger/index.js:24"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `elm.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"server/swagger/index.js","line":24,"fingerprint":"javascript.browser.security.insecure-innerhtml:server/swagger/index.js:24"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"server/swagger/index.js","line":26,"fingerprint":"javascript.browser.security.insecure-document-method:server/swagger/index.js:26"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `elm.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"server/swagger/index.js","line":26,"fingerprint":"javascript.browser.security.insecure-innerhtml:server/swagger/index.js:26"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `rgPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"server/utils/files/index.js","line":589,"fingerprint":"javascript.lang.security.detect-child-process:server/utils/files/index.js:589"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/convertAudioToWav/index.js","line":21,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/convertAudioToWav/index.js:21"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/convertAudioToWav/index.js","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/convertAudioToWav/index.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/convertAudioToWav/index.js","line":40,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/convertAudioToWav/index.js:40"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/processSingleFile/index.js","line":27,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/processSingleFile/index.js:27"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/processSingleFile/index.js","line":49,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/processSingleFile/index.js:49"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetFilename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/processSingleFile/index.js","line":49,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/processSingleFile/index.js:49"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"collector/processSingleFile/index.js","line":83,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:collector/processSingleFile/index.js:83"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/OCRLoader/index.js","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/OCRLoader/index.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/OCRLoader/index.js","line":77,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/OCRLoader/index.js:77"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/OCRLoader/index.js","line":86,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/OCRLoader/index.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/OCRLoader/index.js","line":226,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/OCRLoader/index.js:226"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/OCRLoader/index.js","line":227,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/OCRLoader/index.js:227"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `fullFilePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/WhisperProviders/GenericOpenAiWhisper.js","line":25,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/WhisperProviders/GenericOpenAiWhisper.js:25"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `fullFilePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/WhisperProviders/OpenAiWhisper.js","line":23,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/WhisperProviders/OpenAiWhisper.js:23"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `pathToTest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/WhisperProviders/ffmpeg/index.js","line":64,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/WhisperProviders/ffmpeg/index.js:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `inputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/WhisperProviders/ffmpeg/index.js","line":82,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/WhisperProviders/ffmpeg/index.js:82"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/WhisperProviders/ffmpeg/index.js","line":85,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/WhisperProviders/ffmpeg/index.js:85"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/WhisperProviders/ffmpeg/index.js","line":85,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/WhisperProviders/ffmpeg/index.js:85"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/WhisperProviders/localWhisper.js","line":20,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/WhisperProviders/localWhisper.js:20"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/downloadURIToFile/index.js","line":75,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/downloadURIToFile/index.js:75"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `url` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/downloadURIToFile/index.js","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/downloadURIToFile/index.js:76"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"collector/utils/extensions/Confluence/ConfluenceLoader/index.js","line":117,"fingerprint":"javascript.lang.security.html-in-template-string:collector/utils/extensions/Confluence/ConfluenceLoader/index.js:117"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/DrupalWiki/DrupalWiki/index.js","line":259,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:259"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/DrupalWiki/DrupalWiki/index.js","line":260,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:260"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/DrupalWiki/DrupalWiki/index.js","line":260,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:260"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/RepoLoader/GiteaRepo/index.js","line":45,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/RepoLoader/GiteaRepo/index.js:45"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/RepoLoader/GiteaRepo/index.js","line":47,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/RepoLoader/GiteaRepo/index.js:47"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/RepoLoader/GiteaRepo/index.js","line":49,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/RepoLoader/GiteaRepo/index.js:49"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/RepoLoader/GiteaRepo/index.js","line":50,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/RepoLoader/GiteaRepo/index.js:50"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/RepoLoader/GithubRepo/index.js","line":45,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/RepoLoader/GithubRepo/index.js:45"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/RepoLoader/GithubRepo/index.js","line":47,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/RepoLoader/GithubRepo/index.js:47"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/RepoLoader/GithubRepo/index.js","line":49,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/RepoLoader/GithubRepo/index.js:49"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/RepoLoader/GithubRepo/index.js","line":50,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/RepoLoader/GithubRepo/index.js:50"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/RepoLoader/GitlabRepo/index.js","line":45,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/RepoLoader/GitlabRepo/index.js:45"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/RepoLoader/GitlabRepo/index.js","line":47,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/RepoLoader/GitlabRepo/index.js:47"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/RepoLoader/GitlabRepo/index.js","line":49,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/RepoLoader/GitlabRepo/index.js:49"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/RepoLoader/GitlabRepo/index.js","line":50,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/RepoLoader/GitlabRepo/index.js:50"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/extensions/WebsiteDepth/index.js","line":230,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/extensions/WebsiteDepth/index.js:230"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `startUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/WebsiteDepth/index.js","line":235,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/WebsiteDepth/index.js:235"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `startUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/WebsiteDepth/index.js","line":236,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/WebsiteDepth/index.js:236"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ url }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/YoutubeTranscript/index.js","line":154,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/YoutubeTranscript/index.js:154"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ url }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/extensions/YoutubeTranscript/index.js","line":155,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/extensions/YoutubeTranscript/index.js:155"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":32,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:32"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":68,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:68"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":70,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:70"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":71,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:71"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":87,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:87"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":90,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:90"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":96,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:96"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":102,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:102"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{\n  data = {},\n  filename,\n  destinationOverride = null,\n  options = {},\n}` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlle [confidence low]","path":"collector/utils/files/index.js","line":140,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:140"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `files` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":168,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:168"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/files/index.js","line":168,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/files/index.js:168"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `files` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"collector/utils/files/index.js","line":183,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:collector/utils/files/index.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/files/index.js","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/files/index.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/files/index.js","line":209,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/files/index.js:209"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"collector/utils/files/index.js","line":210,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:collector/utils/files/index.js:210"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"extras/translator/index.mjs","line":10,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:extras/translator/index.mjs:10"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"extras/translator/index.mjs","line":21,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:extras/translator/index.mjs:21"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `langCode` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"extras/translator/index.mjs","line":232,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:extras/translator/index.mjs:232"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"frontend/src/locales/findUnusedTranslations.mjs","line":68,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:frontend/src/locales/findUnusedTranslations.mjs:68"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"frontend/src/locales/findUnusedTranslations.mjs","line":69,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:frontend/src/locales/findUnusedTranslations.mjs:69"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"frontend/src/locales/findUnusedTranslations.mjs","line":69,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:frontend/src/locales/findUnusedTranslations.mjs:69"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"frontend/src/locales/findUnusedTranslations.mjs","line":187,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:frontend/src/locales/findUnusedTranslations.mjs:187"},{"rule_id":"opengrep/javascript.browser.security.wildcard-postmessage-configuration","severity":"medium","message":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]","path":"frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/BrowserExtensionApiKeyRow/index.jsx","line":50,"fingerprint":"javascript.browser.security.wildcard-postmessage-configuration:frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/BrowserExtensionApiKeyRow/index.jsx:50"},{"rule_id":"opengrep/javascript.browser.security.wildcard-postmessage-configuration","severity":"medium","message":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]","path":"frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/NewBrowserExtensionApiKeyModal/index.jsx","line":32,"fingerprint":"javascript.browser.security.wildcard-postmessage-configuration:frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/NewBrowserExtensionApiKeyModal/index.jsx:32"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\d+(-\\d+)?(,\\d+(-\\d+)?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"frontend/src/pages/GeneralSettings/ScheduledJobs/utils/cron.js","line":166,"fingerprint":"javascript.lang.security.audit.detect-redos:frontend/src/pages/GeneralSettings/ScheduledJobs/utils/cron.js:166"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\d+(,\\d+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library which offers de [confidence low]","path":"frontend/src/pages/GeneralSettings/ScheduledJobs/utils/cron.js","line":356,"fingerprint":"javascript.lang.security.audit.detect-redos:frontend/src/pages/GeneralSettings/ScheduledJobs/utils/cron.js:356"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/src/utils/chat/markdown.js","line":27,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/src/utils/chat/markdown.js:27"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/src/utils/chat/markdown.js","line":45,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/src/utils/chat/markdown.js:45"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/src/utils/chat/markdown.js","line":66,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/src/utils/chat/markdown.js:66"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/src/utils/chat/markdown.js","line":76,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/src/utils/chat/markdown.js:76"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/src/utils/chat/plugins/markdown-katex.js","line":227,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/src/utils/chat/plugins/markdown-katex.js:227"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/src/utils/chat/plugins/markdown-katex.js","line":228,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/src/utils/chat/plugins/markdown-katex.js:228"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"frontend/src/utils/keyboardShortcuts.js","line":112,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:frontend/src/utils/keyboardShortcuts.js:112"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/tailwind.config.js","line":10,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/tailwind.config.js:10"},{"rule_id":"opengrep/javascript.express.security.audit.xss.direct-response-write","severity":"medium","message":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML. [confidence medium]","path":"server/endpoints/agentFileServer.js","line":84,"fingerprint":"javascript.express.security.audit.xss.direct-response-write:server/endpoints/agentFileServer.js:84"},{"rule_id":"opengrep/javascript.express.security.audit.express-path-join-resolve-traversal","severity":"medium","message":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination [confidence medium]","path":"server/endpoints/agentFileServer.js","line":123,"fingerprint":"javascript.express.security.audit.express-path-join-resolve-traversal:server/endpoints/agentFileServer.js:123"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/agentFileServer.js","line":123,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/agentFileServer.js:123"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/agentFileServer.js","line":126,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/agentFileServer.js:126"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/api/document/index.js","line":1024,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/api/document/index.js:1024"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/api/document/index.js","line":1025,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/api/document/index.js:1025"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/api/document/index.js","line":1028,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/api/document/index.js:1028"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/api/document/index.js","line":1036,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/api/document/index.js:1036"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/api/document/index.js","line":1170,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/api/document/index.js:1170"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/api/document/index.js","line":1171,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/api/document/index.js:1171"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/api/document/index.js","line":1179,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/api/document/index.js:1179"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/api/document/index.js","line":1179,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/api/document/index.js:1179"},{"rule_id":"opengrep/javascript.express.security.audit.express-path-join-resolve-traversal","severity":"medium","message":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination [confidence medium]","path":"server/endpoints/api/document/index.js","line":1285,"fingerprint":"javascript.express.security.audit.express-path-join-resolve-traversal:server/endpoints/api/document/index.js:1285"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/api/document/index.js","line":1285,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/api/document/index.js:1285"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/api/document/index.js","line":1288,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/api/document/index.js:1288"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/api/document/index.js","line":1292,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/api/document/index.js:1292"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/document.js","line":34,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/document.js:34"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/document.js","line":35,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/document.js:35"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/document.js","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/document.js:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/document.js","line":46,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/document.js:46"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/document.js","line":82,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/document.js:82"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/document.js","line":83,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/document.js:83"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/document.js","line":92,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/document.js:92"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/document.js","line":92,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/document.js:92"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/system.js","line":860,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/system.js:860"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/system.js","line":862,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/system.js:862"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":864,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:864"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":864,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:864"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":864,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:864"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":864,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:864"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/system.js","line":947,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/system.js:947"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/endpoints/system.js","line":949,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/endpoints/system.js:949"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":951,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:951"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":951,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:951"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":951,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:951"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/endpoints/system.js","line":951,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/endpoints/system.js:951"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"server/index.js","line":177,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:server/index.js:177"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/jobs/cleanup-generated-images.js","line":26,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/jobs/cleanup-generated-images.js:26"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/jobs/cleanup-generated-images.js","line":26,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/jobs/cleanup-generated-images.js:26"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/jobs/cleanup-orphan-documents.js","line":19,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/jobs/cleanup-orphan-documents.js:19"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/jobs/cleanup-orphan-documents.js","line":20,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/jobs/cleanup-orphan-documents.js:20"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/jobs/cleanup-orphan-documents.js","line":21,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/jobs/cleanup-orphan-documents.js:21"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/jobs/cleanup-orphan-documents.js","line":22,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/jobs/cleanup-orphan-documents.js:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `batchSize` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/jobs/cleanup-orphan-documents.js","line":34,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/jobs/cleanup-orphan-documents.js:34"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filesToDelete` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/jobs/cleanup-orphan-documents.js","line":34,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/jobs/cleanup-orphan-documents.js:34"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":125,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/models/workspaceParsedFiles.js:125"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":126,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":126,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":126,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:126"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":134,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/models/workspaceParsedFiles.js:134"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":136,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:136"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":136,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:136"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":136,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:136"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":248,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/models/workspaceParsedFiles.js:248"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `thread` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":250,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:250"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":250,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:250"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":250,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:250"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `thread` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":252,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:252"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":252,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:252"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/models/workspaceParsedFiles.js","line":252,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/models/workspaceParsedFiles.js:252"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/swagger/index.js","line":24,"fingerprint":"javascript.lang.security.html-in-template-string:server/swagger/index.js:24"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/swagger/index.js","line":26,"fingerprint":"javascript.lang.security.html-in-template-string:server/swagger/index.js:26"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/cerebras/index.js","line":180,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/cerebras/index.js:180"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/deepseek/index.js","line":128,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/deepseek/index.js:128"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/engine.js","line":235,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/AiProviders/embeddedLemonade/engine.js:235"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":229,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/embeddedLemonade/index.js:229"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `modelId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":524,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/AiProviders/embeddedLemonade/index.js:524"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":571,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/AiProviders/embeddedLemonade/index.js:571"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `repoDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":581,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/AiProviders/embeddedLemonade/index.js:581"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `repoDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":584,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/AiProviders/embeddedLemonade/index.js:584"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":589,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/AiProviders/embeddedLemonade/index.js:589"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":590,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/AiProviders/embeddedLemonade/index.js:590"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":590,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/AiProviders/embeddedLemonade/index.js:590"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/AiProviders/embeddedLemonade/index.js","line":592,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/AiProviders/embeddedLemonade/index.js:592"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/foundry/index.js","line":471,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/foundry/index.js:471"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/foundry/index.js","line":475,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/foundry/index.js:475"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/foundry/index.js","line":503,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/foundry/index.js:503"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/genericOpenAi/index.js","line":219,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/genericOpenAi/index.js:219"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/genericOpenAi/index.js","line":359,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/genericOpenAi/index.js:359"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/genericOpenAi/index.js","line":363,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/genericOpenAi/index.js:363"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/genericOpenAi/index.js","line":389,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/genericOpenAi/index.js:389"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/giteeai/index.js","line":125,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/giteeai/index.js:125"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/koboldCPP/index.js","line":168,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/koboldCPP/index.js:168"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/lemonade/index.js","line":157,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/lemonade/index.js:157"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/llmman/index.js","line":353,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/llmman/index.js:353"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/lmStudio/index.js","line":218,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/lmStudio/index.js:218"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/mistral/index.js","line":154,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/mistral/index.js:154"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/ollama/index.js","line":305,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/ollama/index.js:305"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/omlx/index.js","line":225,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/omlx/index.js:225"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/openAi/index.js","line":283,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/openAi/index.js:283"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/openRouter/index.js","line":234,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/openRouter/index.js:234"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/openRouter/index.js","line":455,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/openRouter/index.js:455"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/openRouter/index.js","line":459,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/openRouter/index.js:459"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/AiProviders/openRouter/index.js","line":487,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/AiProviders/openRouter/index.js:487"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/EmbeddingEngines/native/index.js","line":132,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/EmbeddingEngines/native/index.js:132"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/SpeechToText/helpers.js","line":18,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/SpeechToText/helpers.js:18"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `extension` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/SpeechToText/helpers.js","line":23,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/SpeechToText/helpers.js:23"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/SpeechToText/helpers.js","line":28,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/SpeechToText/helpers.js:28"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `extension` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/SpeechToText/helpers.js","line":29,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/SpeechToText/helpers.js:29"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `extension` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/SpeechToText/helpers.js","line":31,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/SpeechToText/helpers.js:31"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/TextSplitter/index.js","line":145,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/TextSplitter/index.js:145"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"server/utils/agentFlows/executor.js","line":136,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:server/utils/agentFlows/executor.js:136"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"server/utils/agentFlows/executor.js","line":139,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:server/utils/agentFlows/executor.js:139"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"server/utils/agentFlows/executor.js","line":144,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:server/utils/agentFlows/executor.js:144"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"server/utils/agentFlows/executors/web-scraping.js","line":92,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:server/utils/agentFlows/executors/web-scraping.js:92"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"server/utils/agentFlows/executors/web-scraping.js","line":98,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:server/utils/agentFlows/executors/web-scraping.js:98"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"server/utils/agentFlows/executors/web-scraping.js","line":104,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:server/utils/agentFlows/executors/web-scraping.js:104"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"server/utils/agentFlows/executors/web-scraping.js","line":104,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:server/utils/agentFlows/executors/web-scraping.js:104"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agentFlows/index.js","line":72,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agentFlows/index.js:72"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agentFlows/index.js","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agentFlows/index.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agentFlows/index.js","line":80,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agentFlows/index.js:80"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agentFlows/index.js","line":107,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agentFlows/index.js:107"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agentFlows/index.js","line":123,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agentFlows/index.js:123"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agentFlows/index.js","line":158,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agentFlows/index.js:158"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agentFlows/index.js","line":160,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agentFlows/index.js:160"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agentFlows/index.js","line":162,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agentFlows/index.js:162"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/images.js","line":331,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/images.js:331"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/lib.js","line":87,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/create-files/lib.js:87"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/lib.js","line":88,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/create-files/lib.js:88"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/lib.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/create-files/lib.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/lib.js","line":148,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/create-files/lib.js:148"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/lib.js","line":217,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/create-files/lib.js:217"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/lib.js","line":249,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/create-files/lib.js:249"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/images.js","line":341,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/create-files/pptx/images.js:341"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `storageFilename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/images.js","line":342,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/create-files/pptx/images.js:342"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/render.js","line":1304,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:server/utils/agents/aibitat/plugins/create-files/pptx/render.js:1304"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":52,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:52"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":54,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:54"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":130,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:130"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":147,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:147"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":151,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:151"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":157,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:157"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":171,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:171"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":211,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:211"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":212,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:212"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":218,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:218"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":246,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:246"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":253,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:253"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js","line":275,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:275"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\d+(-\\d+)?(,\\d+(-\\d+)?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"server/utils/agents/aibitat/plugins/create-scheduled-job/cronUtils.js","line":118,"fingerprint":"javascript.lang.security.audit.detect-redos:server/utils/agents/aibitat/plugins/create-scheduled-job/cronUtils.js:118"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":12,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:12"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":21,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:21"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":22,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":23,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:23"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":25,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:25"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":25,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:25"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":27,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:27"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":27,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:27"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/copy-file.js","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/copy-file.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ path: dirPath = \"\" }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/create-directory.js","line":67,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/create-directory.js:67"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":68,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:68"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `directories` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":77,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:77"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:96"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":121,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:121"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":162,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:162"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":166,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:166"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":179,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:179"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":212,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:212"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":213,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:213"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":213,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:213"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":216,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:216"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":265,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:265"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":322,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:322"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":327,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:327"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":387,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:387"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":449,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:449"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `requestedPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":466,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:466"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `requestedPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":486,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:486"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":516,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:516"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":551,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:551"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":569,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:569"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `currentPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":705,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:705"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":708,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:708"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":708,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/lib.js:708"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/lib.js","line":815,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/lib.js:815"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{\n            path: dirPath = \"\",\n            includeSizes = false,\n            sortBy = \"name\",\n          }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To addres [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/list-directory.js","line":78,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/list-directory.js:78"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/list-directory.js","line":102,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/list-directory.js:102"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/list-directory.js","line":102,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:server/utils/agents/aibitat/plugins/filesystem/list-directory.js:102"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `entry` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/list-directory.js","line":104,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/list-directory.js:104"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{\n            path: dirPath = \"\",\n            includeSizes = false,\n            sortBy = \"name\",\n          }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To addres [confidence low]","path":"server/utils/agents/aibitat/plugins/filesystem/list-directory.js","line":104,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/filesystem/list-directory.js:104"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":34,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:34"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":44,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:44"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":85,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:85"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":92,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:92"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":93,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:93"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":115,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:115"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/gmail/lib.js","line":117,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/gmail/lib.js:117"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":267,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:267"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":271,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:271"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":281,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:281"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":322,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:322"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":329,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:329"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":330,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:330"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":352,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:352"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"server/utils/agents/aibitat/plugins/outlook/lib.js","line":354,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:server/utils/agents/aibitat/plugins/outlook/lib.js:354"},{"rule_id":"opengrep/javascript.lang.security.audit.sqli.node-mssql-sqli","severity":"medium","message":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameteri [confidence low]","path":"server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MSSQL.js","line":77,"fingerprint":"javascript.lang.security.audit.sqli.node-mssql-sqli:server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MSSQL.js:77"},{"rule_id":"opengrep/javascript.lang.security.audit.sqli.node-mysql-sqli","severity":"medium","message":"Detected a `mysql2/promise` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. [confidence low]","path":"server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MySQL.js","line":42,"fingerprint":"javascript.lang.security.audit.sqli.node-mysql-sqli:server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MySQL.js:42"},{"rule_id":"opengrep/javascript.lang.security.audit.sqli.node-mysql-sqli","severity":"medium","message":"Detected a `mysql2/promise` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. [confidence low]","path":"server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MySQL.js","line":43,"fingerprint":"javascript.lang.security.audit.sqli.node-mysql-sqli:server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MySQL.js:43"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/dereferenceSchema.js","line":39,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:server/utils/agents/aibitat/providers/helpers/dereferenceSchema.js:39"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/responsesTooled.js","line":203,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/responsesTooled.js:203"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/responsesTooled.js","line":267,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/responsesTooled.js:267"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/tooled.js","line":285,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/tooled.js:285"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/tooled.js","line":385,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/tooled.js:385"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/tooled.js","line":499,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/tooled.js:499"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/untooled.js","line":263,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/untooled.js:263"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/untooled.js","line":410,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/untooled.js:410"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/helpers/untooled.js","line":484,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/helpers/untooled.js:484"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"server/utils/agents/aibitat/providers/llmman.js","line":468,"fingerprint":"javascript.lang.security.html-in-template-string:server/utils/agents/aibitat/providers/llmman.js:468"}],"evidence":[],"data":{"rulesets":["javascript","bash","terraform","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":131.0,"vulnerabilities":503.0,"vulns_critical":10.0,"vulns_high":230.0,"vulns_medium":218.0,"vulns_low":38.0,"vulns_unknown":7.0,"penalty":913.0},"findings":[{"rule_id":"osv/GHSA-5rq4-664w-9x2c","severity":"critical","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-5rq4-664w-9x2c","path":"collector/yarn.lock","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-5rq4-664w-9x2c"},{"rule_id":"osv/GHSA-hrh2-vp3x-79xf","severity":"critical","message":"decompress@4.2.1 (npm) is affected by GHSA-hrh2-vp3x-79xf","path":"collector/yarn.lock","line":null,"fingerprint":"decompress@4.2.1 (npm):GHSA-hrh2-vp3x-79xf"},{"rule_id":"osv/GHSA-mp2f-45pm-3cg9","severity":"critical","message":"decompress@4.2.1 (npm) is affected by GHSA-mp2f-45pm-3cg9","path":"collector/yarn.lock","line":null,"fingerprint":"decompress@4.2.1 (npm):GHSA-mp2f-45pm-3cg9"},{"rule_id":"osv/GHSA-q9v2-7m5w-4693","severity":"critical","message":"expr-eval@2.0.2 (npm) is affected by GHSA-q9v2-7m5w-4693; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"expr-eval@2.0.2 (npm):GHSA-q9v2-7m5w-4693"},{"rule_id":"osv/GHSA-xq3m-2v4x-88gg","severity":"critical","message":"protobufjs@6.11.4 (npm) is affected by GHSA-xq3m-2v4x-88gg; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-xq3m-2v4x-88gg"},{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-xq3m-2v4x-88gg","severity":"critical","message":"protobufjs@7.3.2 (npm) is affected by GHSA-xq3m-2v4x-88gg","path":"frontend/yarn.lock","line":null,"fingerprint":"protobufjs@7.3.2 (npm):GHSA-xq3m-2v4x-88gg"},{"rule_id":"osv/GHSA-m7jm-9gc2-mpf2","severity":"critical","message":"fast-xml-parser@4.5.0 (npm) is affected by GHSA-m7jm-9gc2-mpf2","path":"server/yarn.lock","line":null,"fingerprint":"fast-xml-parser@4.5.0 (npm):GHSA-m7jm-9gc2-mpf2"},{"rule_id":"osv/GHSA-h755-8qp9-cq85","severity":"critical","message":"protobufjs@7.2.4 (npm) is affected by GHSA-h755-8qp9-cq85","path":"server/yarn.lock","line":null,"fingerprint":"protobufjs@7.2.4 (npm):GHSA-h755-8qp9-cq85"},{"rule_id":"osv/GHSA-xq3m-2v4x-88gg","severity":"critical","message":"protobufjs@7.2.4 (npm) is affected by GHSA-xq3m-2v4x-88gg","path":"server/yarn.lock","line":null,"fingerprint":"protobufjs@7.2.4 (npm):GHSA-xq3m-2v4x-88gg"},{"rule_id":"osv/GHSA-x8mw-p69m-v3mx","severity":"high","message":"@fastify/busboy@2.1.1 (npm) is affected by GHSA-x8mw-p69m-v3mx","path":"collector/yarn.lock","line":null,"fingerprint":"@fastify/busboy@2.1.1 (npm):GHSA-x8mw-p69m-v3mx"},{"rule_id":"osv/GHSA-r399-636x-v7f6","severity":"high","message":"@langchain/core@0.1.63 (npm) is affected by GHSA-r399-636x-v7f6","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/core@0.1.63 (npm):GHSA-r399-636x-v7f6"},{"rule_id":"osv/GHSA-r399-636x-v7f6","severity":"high","message":"@langchain/core@0.2.36 (npm) is affected by GHSA-r399-636x-v7f6","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/core@0.2.36 (npm):GHSA-r399-636x-v7f6"},{"rule_id":"osv/GHSA-27p8-2357-5qqv","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-27p8-2357-5qqv","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-27p8-2357-5qqv"},{"rule_id":"osv/GHSA-2v35-w6hq-6mfw","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-2v35-w6hq-6mfw","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-2v35-w6hq-6mfw"},{"rule_id":"osv/GHSA-4w3w-2rp5-g8jm","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-4w3w-2rp5-g8jm","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-4w3w-2rp5-g8jm"},{"rule_id":"osv/GHSA-8344-3jmq-59r6","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-8344-3jmq-59r6","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-8344-3jmq-59r6"},{"rule_id":"osv/GHSA-93r5-fhx6-vmg9","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-93r5-fhx6-vmg9","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-93r5-fhx6-vmg9"},{"rule_id":"osv/GHSA-965w-775f-mr7g","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-965w-775f-mr7g","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-965w-775f-mr7g"},{"rule_id":"osv/GHSA-c7q8-3ch8-vqpv","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-c7q8-3ch8-vqpv","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-c7q8-3ch8-vqpv"},{"rule_id":"osv/GHSA-f6ww-3ggp-fr8h","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-f6ww-3ggp-fr8h","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-f6ww-3ggp-fr8h"},{"rule_id":"osv/GHSA-j759-j44w-7fr8","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-j759-j44w-7fr8","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-j759-j44w-7fr8"},{"rule_id":"osv/GHSA-w2rr-34g9-rvrj","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-w2rr-34g9-rvrj","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-w2rr-34g9-rvrj"},{"rule_id":"osv/GHSA-wh4c-j3r5-mjhp","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-wh4c-j3r5-mjhp","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-wh4c-j3r5-mjhp"},{"rule_id":"osv/GHSA-x4fp-j954-r2f4","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-x4fp-j954-r2f4","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-x4fp-j954-r2f4"},{"rule_id":"osv/GHSA-x6wf-f3px-wcqx","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-x6wf-f3px-wcqx","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-x6wf-f3px-wcqx"},{"rule_id":"osv/GHSA-7q85-xj36-vmfc","severity":"high","message":"adm-zip@0.5.16 (npm) is affected by GHSA-7q85-xj36-vmfc; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-7q85-xj36-vmfc"},{"rule_id":"osv/GHSA-8238-w5pm-2374","severity":"high","message":"adm-zip@0.5.16 (npm) is affected by GHSA-8238-w5pm-2374; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-8238-w5pm-2374"},{"rule_id":"osv/GHSA-j5f4-cc29-5x44","severity":"high","message":"adm-zip@0.5.16 (npm) is affected by GHSA-j5f4-cc29-5x44; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-j5f4-cc29-5x44"},{"rule_id":"osv/GHSA-rcw4-f5rp-g42v","severity":"high","message":"adm-zip@0.5.16 (npm) is affected by GHSA-rcw4-f5rp-g42v; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-rcw4-f5rp-g42v"},{"rule_id":"osv/GHSA-xcpc-8h2w-3j85","severity":"high","message":"adm-zip@0.5.16 (npm) is affected by GHSA-xcpc-8h2w-3j85; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-xcpc-8h2w-3j85"},{"rule_id":"osv/GHSA-6v7q-wjvx-w8wg","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-6v7q-wjvx-w8wg","path":"collector/yarn.lock","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-6v7q-wjvx-w8wg"},{"rule_id":"osv/GHSA-c475-qrg2-pj4r","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-c475-qrg2-pj4r","path":"collector/yarn.lock","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-c475-qrg2-pj4r"},{"rule_id":"osv/GHSA-rp42-5vxx-qpwr","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-rp42-5vxx-qpwr","path":"collector/yarn.lock","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-rp42-5vxx-qpwr"},{"rule_id":"osv/GHSA-rpmf-866q-6p89","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-rpmf-866q-6p89","path":"collector/yarn.lock","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-rpmf-866q-6p89"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@1.20.4 (npm) is affected by GHSA-27r3-jxmh-p828; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"body-parser@1.20.4 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-8gw3-rxh4-v6jx","severity":"high","message":"expr-eval@2.0.2 (npm) is affected by GHSA-8gw3-rxh4-v6jx; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"expr-eval@2.0.2 (npm):GHSA-8gw3-rxh4-v6jx"},{"rule_id":"osv/GHSA-jc85-fpwf-qm7x","severity":"high","message":"expr-eval@2.0.2 (npm) is affected by GHSA-jc85-fpwf-qm7x; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"expr-eval@2.0.2 (npm):GHSA-jc85-fpwf-qm7x"},{"rule_id":"osv/GHSA-7pqw-9j4j-h8q3","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-7pqw-9j4j-h8q3","path":"collector/yarn.lock","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-7pqw-9j4j-h8q3"},{"rule_id":"osv/GHSA-jmr9-qjv8-65gv","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-jmr9-qjv8-65gv","path":"collector/yarn.lock","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-jmr9-qjv8-65gv"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.4 (npm) is affected by GHSA-25h7-pfq9-p65f","path":"collector/yarn.lock","line":null,"fingerprint":"flatted@3.3.4 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.4 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"collector/yarn.lock","line":null,"fingerprint":"flatted@3.3.4 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.5 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"collector/yarn.lock","line":null,"fingerprint":"form-data@4.0.5 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.1.0 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"collector/yarn.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-r399-636x-v7f6","severity":"high","message":"langchain@0.1.36 (npm) is affected by GHSA-r399-636x-v7f6; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"langchain@0.1.36 (npm):GHSA-r399-636x-v7f6"},{"rule_id":"osv/GHSA-r399-636x-v7f6","severity":"high","message":"langchain@0.2.20 (npm) is affected by GHSA-r399-636x-v7f6","path":"collector/yarn.lock","line":null,"fingerprint":"langchain@0.2.20 (npm):GHSA-r399-636x-v7f6"},{"rule_id":"osv/GHSA-3644-q5cj-c5c7","severity":"high","message":"langsmith@0.1.68 (npm) is affected by GHSA-3644-q5cj-c5c7","path":"collector/yarn.lock","line":null,"fingerprint":"langsmith@0.1.68 (npm):GHSA-3644-q5cj-c5c7"},{"rule_id":"osv/GHSA-22p9-wv53-3rq4","severity":"high","message":"linkify-it@5.0.0 (npm) is affected by GHSA-22p9-wv53-3rq4","path":"collector/yarn.lock","line":null,"fingerprint":"linkify-it@5.0.0 (npm):GHSA-22p9-wv53-3rq4"},{"rule_id":"osv/GHSA-v245-v573-v5vm","severity":"high","message":"linkify-it@5.0.0 (npm) is affected by GHSA-v245-v573-v5vm","path":"collector/yarn.lock","line":null,"fingerprint":"linkify-it@5.0.0 (npm):GHSA-v245-v573-v5vm"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.21 (npm) is affected by GHSA-r5fr-rjxr-66jc; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-23c5-xmqv-rm74; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-3ppc-4f35-3m26; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-7r86-cg39-jmmj; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-23c5-xmqv-rm74; also in frontend/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-3ppc-4f35-3m26; also in frontend/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-7r86-cg39-jmmj; also in frontend/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-2x7j-588g-ccc2","severity":"high","message":"nodemailer@7.0.10 (npm) is affected by GHSA-2x7j-588g-ccc2","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-2x7j-588g-ccc2"},{"rule_id":"osv/GHSA-p6gq-j5cr-w38f","severity":"high","message":"nodemailer@7.0.10 (npm) is affected by GHSA-p6gq-j5cr-w38f","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-p6gq-j5cr-w38f"},{"rule_id":"osv/GHSA-r7g4-qg5f-qqm2","severity":"high","message":"nodemailer@7.0.10 (npm) is affected by GHSA-r7g4-qg5f-qqm2","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-r7g4-qg5f-qqm2"},{"rule_id":"osv/GHSA-rcmh-qjqh-p98v","severity":"high","message":"nodemailer@7.0.10 (npm) is affected by GHSA-rcmh-qjqh-p98v","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-rcmh-qjqh-p98v"},{"rule_id":"osv/GHSA-v53p-9fqp-m79j","severity":"high","message":"nodemailer@7.0.10 (npm) is affected by GHSA-v53p-9fqp-m79j","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-v53p-9fqp-m79j"},{"rule_id":"osv/GHSA-37ch-88jc-xwx2","severity":"high","message":"path-to-regexp@0.1.12 (npm) is affected by GHSA-37ch-88jc-xwx2; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"path-to-regexp@0.1.12 (npm):GHSA-37ch-88jc-xwx2"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-66ff-xgx4-vchm","severity":"high","message":"protobufjs@6.11.4 (npm) is affected by GHSA-66ff-xgx4-vchm; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-66ff-xgx4-vchm"},{"rule_id":"osv/GHSA-685m-2w69-288q","severity":"high","message":"protobufjs@6.11.4 (npm) is affected by GHSA-685m-2w69-288q; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-685m-2w69-288q"},{"rule_id":"osv/GHSA-75px-5xx7-5xc7","severity":"high","message":"protobufjs@6.11.4 (npm) is affected by GHSA-75px-5xx7-5xc7; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-75px-5xx7-5xc7"},{"rule_id":"osv/GHSA-jvwf-75h9-cwgg","severity":"high","message":"protobufjs@6.11.4 (npm) is affected by GHSA-jvwf-75h9-cwgg; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-jvwf-75h9-cwgg"},{"rule_id":"osv/GHSA-wcpc-wj8m-hjx6","severity":"high","message":"protobufjs@6.11.4 (npm) is affected by GHSA-wcpc-wj8m-hjx6; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-wcpc-wj8m-hjx6"},{"rule_id":"osv/GHSA-c2qf-rxjj-qqgw","severity":"high","message":"semver@7.0.0 (npm) is affected by GHSA-c2qf-rxjj-qqgw; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"semver@7.0.0 (npm):GHSA-c2qf-rxjj-qqgw"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.32.6 (npm) is affected by GHSA-f88m-g3jw-g9cj; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"sharp@0.32.6 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.32.6 (npm) is affected by GHSA-rgj7-g3m4-5g8c; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"sharp@0.32.6 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.32.6 (npm) is affected by GHSA-wq5f-xc86-pv6w; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"sharp@0.32.6 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.33.5 (npm) is affected by GHSA-f88m-g3jw-g9cj","path":"collector/yarn.lock","line":null,"fingerprint":"sharp@0.33.5 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.33.5 (npm) is affected by GHSA-rgj7-g3m4-5g8c","path":"collector/yarn.lock","line":null,"fingerprint":"sharp@0.33.5 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.33.5 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"collector/yarn.lock","line":null,"fingerprint":"sharp@0.33.5 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-8cj5-5rvv-wf4v","severity":"high","message":"tar-fs@3.0.4 (npm) is affected by GHSA-8cj5-5rvv-wf4v","path":"collector/yarn.lock","line":null,"fingerprint":"tar-fs@3.0.4 (npm):GHSA-8cj5-5rvv-wf4v"},{"rule_id":"osv/GHSA-pq67-2wwv-3xjx","severity":"high","message":"tar-fs@3.0.4 (npm) is affected by GHSA-pq67-2wwv-3xjx","path":"collector/yarn.lock","line":null,"fingerprint":"tar-fs@3.0.4 (npm):GHSA-pq67-2wwv-3xjx"},{"rule_id":"osv/GHSA-vj76-c3g6-qr5v","severity":"high","message":"tar-fs@3.0.4 (npm) is affected by GHSA-vj76-c3g6-qr5v","path":"collector/yarn.lock","line":null,"fingerprint":"tar-fs@3.0.4 (npm):GHSA-vj76-c3g6-qr5v"},{"rule_id":"osv/GHSA-qpx9-hpmf-5gmw","severity":"high","message":"underscore@1.13.7 (npm) is affected by GHSA-qpx9-hpmf-5gmw","path":"collector/yarn.lock","line":null,"fingerprint":"underscore@1.13.7 (npm):GHSA-qpx9-hpmf-5gmw"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"collector/yarn.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"collector/yarn.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-v9p9-hfj2-hcw8","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-v9p9-hfj2-hcw8","path":"collector/yarn.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-v9p9-hfj2-hcw8"},{"rule_id":"osv/GHSA-vrm6-8vpv-qv8q","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-vrm6-8vpv-qv8q","path":"collector/yarn.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-vrm6-8vpv-qv8q"},{"rule_id":"osv/GHSA-vxpw-j846-p89q","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-vxpw-j846-p89q","path":"collector/yarn.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-vxpw-j846-p89q"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@10.0.0 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"collector/yarn.lock","line":null,"fingerprint":"uuid@10.0.0 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@9.0.1 (npm) is affected by GHSA-w5hq-g745-h8pq; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"uuid@9.0.1 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-3h5v-q93c-6h6q","severity":"high","message":"ws@8.14.2 (npm) is affected by GHSA-3h5v-q93c-6h6q","path":"collector/yarn.lock","line":null,"fingerprint":"ws@8.14.2 (npm):GHSA-3h5v-q93c-6h6q"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.14.2 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"collector/yarn.lock","line":null,"fingerprint":"ws@8.14.2 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-4r6h-8v6p-xvw6","severity":"high","message":"xlsx@0.20.2 (npm) is affected by GHSA-4r6h-8v6p-xvw6","path":"collector/yarn.lock","line":null,"fingerprint":"xlsx@0.20.2 (npm):GHSA-4r6h-8v6p-xvw6"},{"rule_id":"osv/GHSA-5pgg-2g8v-p4x9","severity":"high","message":"xlsx@0.20.2 (npm) is affected by GHSA-5pgg-2g8v-p4x9","path":"collector/yarn.lock","line":null,"fingerprint":"xlsx@0.20.2 (npm):GHSA-5pgg-2g8v-p4x9"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"collector/yarn.lock","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-2w69-qvjg-hvjx","severity":"high","message":"@remix-run/router@1.18.0 (npm) is affected by GHSA-2w69-qvjg-hvjx","path":"frontend/yarn.lock","line":null,"fingerprint":"@remix-run/router@1.18.0 (npm):GHSA-2w69-qvjg-hvjx"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in server/yarn.lock","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in server/yarn.lock","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-mh99-v99m-4gvg; also in server/yarn.lock","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-qhr7-859c-m2p7; also in server/yarn.lock","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-rgw5-rvv9-x895; also in server/yarn.lock","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"frontend/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.23.2 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"frontend/yarn.lock","line":null,"fingerprint":"browserslist@4.23.2 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.23.2 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"frontend/yarn.lock","line":null,"fingerprint":"browserslist@4.23.2 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"frontend/yarn.lock","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"frontend/yarn.lock","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-3xgq-45jj-v275","severity":"high","message":"cross-spawn@7.0.3 (npm) is affected by GHSA-3xgq-45jj-v275","path":"frontend/yarn.lock","line":null,"fingerprint":"cross-spawn@7.0.3 (npm):GHSA-3xgq-45jj-v275"},{"rule_id":"osv/GHSA-mrv2-3pqr-j5jr","severity":"high","message":"dompurify@3.1.6 (npm) is affected by GHSA-mrv2-3pqr-j5jr","path":"frontend/yarn.lock","line":null,"fingerprint":"dompurify@3.1.6 (npm):GHSA-mrv2-3pqr-j5jr"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.1 (npm) is affected by GHSA-25h7-pfq9-p65f; also in server/yarn.lock","path":"frontend/yarn.lock","line":null,"fingerprint":"flatted@3.3.1 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.1 (npm) is affected by GHSA-rf6f-7fwh-wjgh; also in server/yarn.lock","path":"frontend/yarn.lock","line":null,"fingerprint":"flatted@3.3.1 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-5j98-mcp5-4vw2","severity":"high","message":"glob@10.4.5 (npm) is affected by GHSA-5j98-mcp5-4vw2","path":"frontend/yarn.lock","line":null,"fingerprint":"glob@10.4.5 (npm):GHSA-5j98-mcp5-4vw2"},{"rule_id":"osv/GHSA-22p9-wv53-3rq4","severity":"high","message":"linkify-it@4.0.1 (npm) is affected by GHSA-22p9-wv53-3rq4","path":"frontend/yarn.lock","line":null,"fingerprint":"linkify-it@4.0.1 (npm):GHSA-22p9-wv53-3rq4"},{"rule_id":"osv/GHSA-v245-v573-v5vm","severity":"high","message":"linkify-it@4.0.1 (npm) is affected by GHSA-v245-v573-v5vm","path":"frontend/yarn.lock","line":null,"fingerprint":"linkify-it@4.0.1 (npm):GHSA-v245-v573-v5vm"},{"rule_id":"osv/GHSA-r7fv-28h4-cvq7","severity":"high","message":"markdown-it@13.0.2 (npm) is affected by GHSA-r7fv-28h4-cvq7","path":"frontend/yarn.lock","line":null,"fingerprint":"markdown-it@13.0.2 (npm):GHSA-r7fv-28h4-cvq7"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.7 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"frontend/yarn.lock","line":null,"fingerprint":"nanoid@3.3.7 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.7 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"frontend/yarn.lock","line":null,"fingerprint":"nanoid@3.3.7 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.7 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"frontend/yarn.lock","line":null,"fingerprint":"nanoid@3.3.7 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.4.39 (npm) is affected by GHSA-6g55-p6wh-862q","path":"frontend/yarn.lock","line":null,"fingerprint":"postcss@8.4.39 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.4.39 (npm) is affected by GHSA-r28c-9q8g-f849","path":"frontend/yarn.lock","line":null,"fingerprint":"postcss@8.4.39 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-66ff-xgx4-vchm","severity":"high","message":"protobufjs@7.3.2 (npm) is affected by GHSA-66ff-xgx4-vchm","path":"frontend/yarn.lock","line":null,"fingerprint":"protobufjs@7.3.2 (npm):GHSA-66ff-xgx4-vchm"},{"rule_id":"osv/GHSA-685m-2w69-288q","severity":"high","message":"protobufjs@7.3.2 (npm) is affected by GHSA-685m-2w69-288q","path":"frontend/yarn.lock","line":null,"fingerprint":"protobufjs@7.3.2 (npm):GHSA-685m-2w69-288q"},{"rule_id":"osv/GHSA-75px-5xx7-5xc7","severity":"high","message":"protobufjs@7.3.2 (npm) is affected by GHSA-75px-5xx7-5xc7","path":"frontend/yarn.lock","line":null,"fingerprint":"protobufjs@7.3.2 (npm):GHSA-75px-5xx7-5xc7"},{"rule_id":"osv/GHSA-jvwf-75h9-cwgg","severity":"high","message":"protobufjs@7.3.2 (npm) is affected by GHSA-jvwf-75h9-cwgg","path":"frontend/yarn.lock","line":null,"fingerprint":"protobufjs@7.3.2 (npm):GHSA-jvwf-75h9-cwgg"},{"rule_id":"osv/GHSA-wcpc-wj8m-hjx6","severity":"high","message":"protobufjs@7.3.2 (npm) is affected by GHSA-wcpc-wj8m-hjx6","path":"frontend/yarn.lock","line":null,"fingerprint":"protobufjs@7.3.2 (npm):GHSA-wcpc-wj8m-hjx6"},{"rule_id":"osv/GHSA-gcx4-mw62-g8wm","severity":"high","message":"rollup@3.29.4 (npm) is affected by GHSA-gcx4-mw62-g8wm","path":"frontend/yarn.lock","line":null,"fingerprint":"rollup@3.29.4 (npm):GHSA-gcx4-mw62-g8wm"},{"rule_id":"osv/GHSA-mw96-cpmx-2vgc","severity":"high","message":"rollup@3.29.4 (npm) is affected by GHSA-mw96-cpmx-2vgc","path":"frontend/yarn.lock","line":null,"fingerprint":"rollup@3.29.4 (npm):GHSA-mw96-cpmx-2vgc"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.0 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"frontend/yarn.lock","line":null,"fingerprint":"source-map-js@1.2.0 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@4.5.3 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"frontend/yarn.lock","line":null,"fingerprint":"vite@4.5.3 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-c27g-q93r-2cwf","severity":"high","message":"vite@4.5.3 (npm) is affected by GHSA-c27g-q93r-2cwf","path":"frontend/yarn.lock","line":null,"fingerprint":"vite@4.5.3 (npm):GHSA-c27g-q93r-2cwf"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.2.0 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"frontend/yarn.lock","line":null,"fingerprint":"zod@4.2.0 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-5375-pq7m-f5r2","severity":"high","message":"@grpc/grpc-js@1.8.17 (npm) is affected by GHSA-5375-pq7m-f5r2","path":"server/yarn.lock","line":null,"fingerprint":"@grpc/grpc-js@1.8.17 (npm):GHSA-5375-pq7m-f5r2"},{"rule_id":"osv/GHSA-99f4-grh7-6pcq","severity":"high","message":"@grpc/grpc-js@1.8.17 (npm) is affected by GHSA-99f4-grh7-6pcq","path":"server/yarn.lock","line":null,"fingerprint":"@grpc/grpc-js@1.8.17 (npm):GHSA-99f4-grh7-6pcq"},{"rule_id":"osv/GHSA-m9gg-hp2v-232j","severity":"high","message":"@grpc/grpc-js@1.8.17 (npm) is affected by GHSA-m9gg-hp2v-232j","path":"server/yarn.lock","line":null,"fingerprint":"@grpc/grpc-js@1.8.17 (npm):GHSA-m9gg-hp2v-232j"},{"rule_id":"osv/GHSA-r399-636x-v7f6","severity":"high","message":"@langchain/core@0.1.61 (npm) is affected by GHSA-r399-636x-v7f6","path":"server/yarn.lock","line":null,"fingerprint":"@langchain/core@0.1.61 (npm):GHSA-r399-636x-v7f6"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.24.3 (npm) is affected by GHSA-22jm-h49p-29qw","path":"server/yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.24.3 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-345p-7cg4-v4c7","severity":"high","message":"@modelcontextprotocol/sdk@1.24.3 (npm) is affected by GHSA-345p-7cg4-v4c7","path":"server/yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.24.3 (npm):GHSA-345p-7cg4-v4c7"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.24.3 (npm) is affected by GHSA-46jr-4wx8-v453","path":"server/yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.24.3 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.24.3 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"server/yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.24.3 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-8r9q-7v3j-jr4g","severity":"high","message":"@modelcontextprotocol/sdk@1.24.3 (npm) is affected by GHSA-8r9q-7v3j-jr4g","path":"server/yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.24.3 (npm):GHSA-8r9q-7v3j-jr4g"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.24.3 (npm) is affected by GHSA-f897-62hf-6gxq","path":"server/yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.24.3 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-35jp-ww65-95wh","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-35jp-ww65-95wh","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-35jp-ww65-95wh"},{"rule_id":"osv/GHSA-3g43-6gmg-66jw","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-3g43-6gmg-66jw","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-3g43-6gmg-66jw"},{"rule_id":"osv/GHSA-43fc-jf86-j433","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-43fc-jf86-j433","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-43fc-jf86-j433"},{"rule_id":"osv/GHSA-4hjh-wcwx-xvwj","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-4hjh-wcwx-xvwj","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-4hjh-wcwx-xvwj"},{"rule_id":"osv/GHSA-62hf-57xw-28j9","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-62hf-57xw-28j9","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-62hf-57xw-28j9"},{"rule_id":"osv/GHSA-6chq-wfr3-2hj9","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-6chq-wfr3-2hj9","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-6chq-wfr3-2hj9"},{"rule_id":"osv/GHSA-hfxv-24rg-xrqf","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-hfxv-24rg-xrqf","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-hfxv-24rg-xrqf"},{"rule_id":"osv/GHSA-j5f8-grm9-p9fc","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-j5f8-grm9-p9fc","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-j5f8-grm9-p9fc"},{"rule_id":"osv/GHSA-jr5f-v2jv-69x6","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-jr5f-v2jv-69x6","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-jr5f-v2jv-69x6"},{"rule_id":"osv/GHSA-p92q-9vqr-4j8v","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-p92q-9vqr-4j8v","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-p92q-9vqr-4j8v"},{"rule_id":"osv/GHSA-pf86-5x62-jrwf","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-pf86-5x62-jrwf","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-pf86-5x62-jrwf"},{"rule_id":"osv/GHSA-pmwg-cvhr-8vh7","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-pmwg-cvhr-8vh7","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-pmwg-cvhr-8vh7"},{"rule_id":"osv/GHSA-q8qp-cvcw-x6jj","severity":"high","message":"axios@1.6.8 (npm) is affected by GHSA-q8qp-cvcw-x6jj","path":"server/yarn.lock","line":null,"fingerprint":"axios@1.6.8 (npm):GHSA-q8qp-cvcw-x6jj"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.1 (npm) is affected by GHSA-27r3-jxmh-p828","path":"server/yarn.lock","line":null,"fingerprint":"body-parser@2.2.1 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"server/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"server/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"server/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"server/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"server/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-grv7-fg5c-xmjg","severity":"high","message":"braces@3.0.2 (npm) is affected by GHSA-grv7-fg5c-xmjg","path":"server/yarn.lock","line":null,"fingerprint":"braces@3.0.2 (npm):GHSA-grv7-fg5c-xmjg"},{"rule_id":"osv/GHSA-mrv2-3pqr-j5jr","severity":"high","message":"dompurify@3.3.3 (npm) is affected by GHSA-mrv2-3pqr-j5jr","path":"server/yarn.lock","line":null,"fingerprint":"dompurify@3.3.3 (npm):GHSA-mrv2-3pqr-j5jr"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc","path":"server/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-8gc5-j5rx-235r","severity":"high","message":"fast-xml-parser@4.5.0 (npm) is affected by GHSA-8gc5-j5rx-235r","path":"server/yarn.lock","line":null,"fingerprint":"fast-xml-parser@4.5.0 (npm):GHSA-8gc5-j5rx-235r"},{"rule_id":"osv/GHSA-jmr7-xgp7-cmfj","severity":"high","message":"fast-xml-parser@4.5.0 (npm) is affected by GHSA-jmr7-xgp7-cmfj","path":"server/yarn.lock","line":null,"fingerprint":"fast-xml-parser@4.5.0 (npm):GHSA-jmr7-xgp7-cmfj"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@3.0.4 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"server/yarn.lock","line":null,"fingerprint":"form-data@3.0.4 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.4 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"server/yarn.lock","line":null,"fingerprint":"form-data@4.0.4 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-5p2g-fcmc-qvqq","severity":"high","message":"image-size@1.2.1 (npm) is affected by GHSA-5p2g-fcmc-qvqq","path":"server/yarn.lock","line":null,"fingerprint":"image-size@1.2.1 (npm):GHSA-5p2g-fcmc-qvqq"},{"rule_id":"osv/GHSA-w3rx-r6r6-pgpr","severity":"high","message":"image-size@1.2.1 (npm) is affected by GHSA-w3rx-r6r6-pgpr","path":"server/yarn.lock","line":null,"fingerprint":"image-size@1.2.1 (npm):GHSA-w3rx-r6r6-pgpr"},{"rule_id":"osv/GHSA-2p57-rm9w-gvfp","severity":"high","message":"ip@2.0.1 (npm) is affected by GHSA-2p57-rm9w-gvfp","path":"server/yarn.lock","line":null,"fingerprint":"ip@2.0.1 (npm):GHSA-2p57-rm9w-gvfp"},{"rule_id":"osv/GHSA-4528-x5fx-h6hg","severity":"high","message":"joi@17.13.0 (npm) is affected by GHSA-4528-x5fx-h6hg","path":"server/yarn.lock","line":null,"fingerprint":"joi@17.13.0 (npm):GHSA-4528-x5fx-h6hg"},{"rule_id":"osv/GHSA-6h2x-m376-mqjq","severity":"high","message":"joi@17.13.0 (npm) is affected by GHSA-6h2x-m376-mqjq","path":"server/yarn.lock","line":null,"fingerprint":"joi@17.13.0 (npm):GHSA-6h2x-m376-mqjq"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"server/yarn.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"server/yarn.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"server/yarn.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-869p-cjfg-cm3x","severity":"high","message":"jws@3.2.2 (npm) is affected by GHSA-869p-cjfg-cm3x","path":"server/yarn.lock","line":null,"fingerprint":"jws@3.2.2 (npm):GHSA-869p-cjfg-cm3x"},{"rule_id":"osv/GHSA-869p-cjfg-cm3x","severity":"high","message":"jws@4.0.0 (npm) is affected by GHSA-869p-cjfg-cm3x","path":"server/yarn.lock","line":null,"fingerprint":"jws@4.0.0 (npm):GHSA-869p-cjfg-cm3x"},{"rule_id":"osv/GHSA-3644-q5cj-c5c7","severity":"high","message":"langsmith@0.1.21 (npm) is affected by GHSA-3644-q5cj-c5c7","path":"server/yarn.lock","line":null,"fingerprint":"langsmith@0.1.21 (npm):GHSA-3644-q5cj-c5c7"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.23 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"server/yarn.lock","line":null,"fingerprint":"lodash@4.17.23 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash-es@4.17.21 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"server/yarn.lock","line":null,"fingerprint":"lodash-es@4.17.21 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-535w-7cp7-47q4","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-535w-7cp7-47q4","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-535w-7cp7-47q4"},{"rule_id":"osv/GHSA-5528-5vmv-3xc2","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-5528-5vmv-3xc2","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-5528-5vmv-3xc2"},{"rule_id":"osv/GHSA-72gw-mp4g-v24j","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-72gw-mp4g-v24j","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-72gw-mp4g-v24j"},{"rule_id":"osv/GHSA-fjgf-rc76-4x9p","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-fjgf-rc76-4x9p","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-fjgf-rc76-4x9p"},{"rule_id":"osv/GHSA-g5hg-p3ph-g8qg","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-g5hg-p3ph-g8qg","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-g5hg-p3ph-g8qg"},{"rule_id":"osv/GHSA-q7qp-rjg7-q26m","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-q7qp-rjg7-q26m","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-q7qp-rjg7-q26m"},{"rule_id":"osv/GHSA-v52c-386h-88mc","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-v52c-386h-88mc","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-v52c-386h-88mc"},{"rule_id":"osv/GHSA-wc9g-mqfw-jrwm","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-wc9g-mqfw-jrwm","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-wc9g-mqfw-jrwm"},{"rule_id":"osv/GHSA-xf7r-hgr6-v32p","severity":"high","message":"multer@2.0.0 (npm) is affected by GHSA-xf7r-hgr6-v32p","path":"server/yarn.lock","line":null,"fingerprint":"multer@2.0.0 (npm):GHSA-xf7r-hgr6-v32p"},{"rule_id":"osv/GHSA-3f6p-5ww8-9rcr","severity":"high","message":"mysql2@3.10.3 (npm) is affected by GHSA-3f6p-5ww8-9rcr","path":"server/yarn.lock","line":null,"fingerprint":"mysql2@3.10.3 (npm):GHSA-3f6p-5ww8-9rcr"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@5.1.7 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"server/yarn.lock","line":null,"fingerprint":"nanoid@5.1.7 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@5.1.7 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"server/yarn.lock","line":null,"fingerprint":"nanoid@5.1.7 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-j3q9-mxjg-w52f","severity":"high","message":"path-to-regexp@8.3.0 (npm) is affected by GHSA-j3q9-mxjg-w52f","path":"server/yarn.lock","line":null,"fingerprint":"path-to-regexp@8.3.0 (npm):GHSA-j3q9-mxjg-w52f"},{"rule_id":"osv/GHSA-66ff-xgx4-vchm","severity":"high","message":"protobufjs@7.2.4 (npm) is affected by GHSA-66ff-xgx4-vchm","path":"server/yarn.lock","line":null,"fingerprint":"protobufjs@7.2.4 (npm):GHSA-66ff-xgx4-vchm"},{"rule_id":"osv/GHSA-685m-2w69-288q","severity":"high","message":"protobufjs@7.2.4 (npm) is affected by GHSA-685m-2w69-288q","path":"server/yarn.lock","line":null,"fingerprint":"protobufjs@7.2.4 (npm):GHSA-685m-2w69-288q"},{"rule_id":"osv/GHSA-75px-5xx7-5xc7","severity":"high","message":"protobufjs@7.2.4 (npm) is affected by GHSA-75px-5xx7-5xc7","path":"server/yarn.lock","line":null,"fingerprint":"protobufjs@7.2.4 (npm):GHSA-75px-5xx7-5xc7"},{"rule_id":"osv/GHSA-jvwf-75h9-cwgg","severity":"high","message":"protobufjs@7.2.4 (npm) is affected by GHSA-jvwf-75h9-cwgg","path":"server/yarn.lock","line":null,"fingerprint":"protobufjs@7.2.4 (npm):GHSA-jvwf-75h9-cwgg"},{"rule_id":"osv/GHSA-wcpc-wj8m-hjx6","severity":"high","message":"protobufjs@7.2.4 (npm) is affected by GHSA-wcpc-wj8m-hjx6","path":"server/yarn.lock","line":null,"fingerprint":"protobufjs@7.2.4 (npm):GHSA-wcpc-wj8m-hjx6"},{"rule_id":"osv/GHSA-8cj5-5rvv-wf4v","severity":"high","message":"tar-fs@2.1.1 (npm) is affected by GHSA-8cj5-5rvv-wf4v","path":"server/yarn.lock","line":null,"fingerprint":"tar-fs@2.1.1 (npm):GHSA-8cj5-5rvv-wf4v"},{"rule_id":"osv/GHSA-pq67-2wwv-3xjx","severity":"high","message":"tar-fs@2.1.1 (npm) is affected by GHSA-pq67-2wwv-3xjx","path":"server/yarn.lock","line":null,"fingerprint":"tar-fs@2.1.1 (npm):GHSA-pq67-2wwv-3xjx"},{"rule_id":"osv/GHSA-vj76-c3g6-qr5v","severity":"high","message":"tar-fs@2.1.1 (npm) is affected by GHSA-vj76-c3g6-qr5v","path":"server/yarn.lock","line":null,"fingerprint":"tar-fs@2.1.1 (npm):GHSA-vj76-c3g6-qr5v"},{"rule_id":"osv/GHSA-8cj5-5rvv-wf4v","severity":"high","message":"tar-fs@3.0.6 (npm) is affected by GHSA-8cj5-5rvv-wf4v","path":"server/yarn.lock","line":null,"fingerprint":"tar-fs@3.0.6 (npm):GHSA-8cj5-5rvv-wf4v"},{"rule_id":"osv/GHSA-pq67-2wwv-3xjx","severity":"high","message":"tar-fs@3.0.6 (npm) is affected by GHSA-pq67-2wwv-3xjx","path":"server/yarn.lock","line":null,"fingerprint":"tar-fs@3.0.6 (npm):GHSA-pq67-2wwv-3xjx"},{"rule_id":"osv/GHSA-vj76-c3g6-qr5v","severity":"high","message":"tar-fs@3.0.6 (npm) is affected by GHSA-vj76-c3g6-qr5v","path":"server/yarn.lock","line":null,"fingerprint":"tar-fs@3.0.6 (npm):GHSA-vj76-c3g6-qr5v"},{"rule_id":"osv/GHSA-ph9p-34f9-6g65","severity":"high","message":"tmp@0.0.33 (npm) is affected by GHSA-ph9p-34f9-6g65","path":"server/yarn.lock","line":null,"fingerprint":"tmp@0.0.33 (npm):GHSA-ph9p-34f9-6g65"},{"rule_id":"osv/GHSA-ph9p-34f9-6g65","severity":"high","message":"tmp@0.2.5 (npm) is affected by GHSA-ph9p-34f9-6g65","path":"server/yarn.lock","line":null,"fingerprint":"tmp@0.2.5 (npm):GHSA-ph9p-34f9-6g65"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@6.21.1 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.21.1 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-f269-vfmq-vjvj","severity":"high","message":"undici@6.21.1 (npm) is affected by GHSA-f269-vfmq-vjvj","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.21.1 (npm):GHSA-f269-vfmq-vjvj"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@6.21.1 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.21.1 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@6.21.1 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.21.1 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-v9p9-hfj2-hcw8","severity":"high","message":"undici@6.21.1 (npm) is affected by GHSA-v9p9-hfj2-hcw8","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.21.1 (npm):GHSA-v9p9-hfj2-hcw8"},{"rule_id":"osv/GHSA-vrm6-8vpv-qv8q","severity":"high","message":"undici@6.21.1 (npm) is affected by GHSA-vrm6-8vpv-qv8q","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.21.1 (npm):GHSA-vrm6-8vpv-qv8q"},{"rule_id":"osv/GHSA-vxpw-j846-p89q","severity":"high","message":"undici@6.21.1 (npm) is affected by GHSA-vxpw-j846-p89q","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.21.1 (npm):GHSA-vxpw-j846-p89q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@6.28.1 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@6.28.1 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@6.28.1 (npm) is affected by GHSA-xjj6-f33q-929c","path":"server/yarn.lock","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@8.3.2 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"server/yarn.lock","line":null,"fingerprint":"uuid@8.3.2 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@7.5.10 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"server/yarn.lock","line":null,"fingerprint":"ws@7.5.10 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.20.0 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"server/yarn.lock","line":null,"fingerprint":"ws@8.20.0 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.23.5 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"server/yarn.lock","line":null,"fingerprint":"zod@3.23.5 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.1.13 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"server/yarn.lock","line":null,"fingerprint":"zod@4.1.13 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-gxm5-99cw-xjw9","severity":"medium","message":"@fastify/busboy@2.1.1 (npm) is affected by GHSA-gxm5-99cw-xjw9","path":"collector/yarn.lock","line":null,"fingerprint":"@fastify/busboy@2.1.1 (npm):GHSA-gxm5-99cw-xjw9"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.7 (npm) is affected by GHSA-p498-v437-472g; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"@humanfs/node@0.16.7 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-6m59-8fmv-m5f9","severity":"medium","message":"@langchain/community@0.0.57 (npm) is affected by GHSA-6m59-8fmv-m5f9","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/community@0.0.57 (npm):GHSA-6m59-8fmv-m5f9"},{"rule_id":"osv/GHSA-gf3v-fwqg-4vh7","severity":"medium","message":"@langchain/community@0.0.57 (npm) is affected by GHSA-gf3v-fwqg-4vh7","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/community@0.0.57 (npm):GHSA-gf3v-fwqg-4vh7"},{"rule_id":"osv/GHSA-mphv-75cg-56wg","severity":"medium","message":"@langchain/community@0.0.57 (npm) is affected by GHSA-mphv-75cg-56wg","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/community@0.0.57 (npm):GHSA-mphv-75cg-56wg"},{"rule_id":"osv/GHSA-6m59-8fmv-m5f9","severity":"medium","message":"@langchain/community@0.2.33 (npm) is affected by GHSA-6m59-8fmv-m5f9","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/community@0.2.33 (npm):GHSA-6m59-8fmv-m5f9"},{"rule_id":"osv/GHSA-gf3v-fwqg-4vh7","severity":"medium","message":"@langchain/community@0.2.33 (npm) is affected by GHSA-gf3v-fwqg-4vh7","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/community@0.2.33 (npm):GHSA-gf3v-fwqg-4vh7"},{"rule_id":"osv/GHSA-mphv-75cg-56wg","severity":"medium","message":"@langchain/community@0.2.33 (npm) is affected by GHSA-mphv-75cg-56wg","path":"collector/yarn.lock","line":null,"fingerprint":"@langchain/community@0.2.33 (npm):GHSA-mphv-75cg-56wg"},{"rule_id":"osv/GHSA-q6x5-8v7m-xcrf","severity":"medium","message":"@protobufjs/utf8@1.1.0 (npm) is affected by GHSA-q6x5-8v7m-xcrf; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"@protobufjs/utf8@1.1.0 (npm):GHSA-q6x5-8v7m-xcrf"},{"rule_id":"osv/GHSA-6gmq-8vp8-gcm6","severity":"medium","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-6gmq-8vp8-gcm6","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-6gmq-8vp8-gcm6"},{"rule_id":"osv/GHSA-6h8r-xr42-gp59","severity":"medium","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-6h8r-xr42-gp59","path":"collector/yarn.lock","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-6h8r-xr42-gp59"},{"rule_id":"osv/GHSA-c6fg-446q-cg94","severity":"medium","message":"adm-zip@0.5.16 (npm) is affected by GHSA-c6fg-446q-cg94; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-c6fg-446q-cg94"},{"rule_id":"osv/GHSA-p634-w6r4-rjp2","severity":"medium","message":"adm-zip@0.5.16 (npm) is affected by GHSA-p634-w6r4-rjp2; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-p634-w6r4-rjp2"},{"rule_id":"osv/GHSA-vwc7-r8mq-g2x9","severity":"medium","message":"adm-zip@0.5.16 (npm) is affected by GHSA-vwc7-r8mq-g2x9; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"adm-zip@0.5.16 (npm):GHSA-vwc7-r8mq-g2x9"},{"rule_id":"osv/GHSA-5pm8-86m8-9m6r","severity":"medium","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-5pm8-86m8-9m6r","path":"collector/yarn.lock","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-5pm8-86m8-9m6r"},{"rule_id":"osv/GHSA-r4jh-29pc-gfqr","severity":"medium","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-r4jh-29pc-gfqr","path":"collector/yarn.lock","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-r4jh-29pc-gfqr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"collector/yarn.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-h39j-r5qq-r9mm","severity":"medium","message":"decompress@4.2.1 (npm) is affected by GHSA-h39j-r5qq-r9mm","path":"collector/yarn.lock","line":null,"fingerprint":"decompress@4.2.1 (npm):GHSA-h39j-r5qq-r9mm"},{"rule_id":"osv/GHSA-jwp9-9v96-94mx","severity":"medium","message":"decompress@4.2.1 (npm) is affected by GHSA-jwp9-9v96-94mx","path":"collector/yarn.lock","line":null,"fingerprint":"decompress@4.2.1 (npm):GHSA-jwp9-9v96-94mx"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-5v7r-6r5c-r473","severity":"medium","message":"file-type@16.5.4 (npm) is affected by GHSA-5v7r-6r5c-r473","path":"collector/yarn.lock","line":null,"fingerprint":"file-type@16.5.4 (npm):GHSA-5v7r-6r5c-r473"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"collector/yarn.lock","line":null,"fingerprint":"glob@10.5.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"collector/yarn.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"collector/yarn.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"collector/yarn.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"collector/yarn.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-v2v4-37r5-5v8g","path":"collector/yarn.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.1 (npm) is affected by GHSA-h67p-54hq-rp68; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-hc5w-c9f8-9cc4","severity":"medium","message":"langchain@0.1.36 (npm) is affected by GHSA-hc5w-c9f8-9cc4; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"langchain@0.1.36 (npm):GHSA-hc5w-c9f8-9cc4"},{"rule_id":"osv/GHSA-fw9q-39r9-c252","severity":"medium","message":"langsmith@0.1.68 (npm) is affected by GHSA-fw9q-39r9-c252","path":"collector/yarn.lock","line":null,"fingerprint":"langsmith@0.1.68 (npm):GHSA-fw9q-39r9-c252"},{"rule_id":"osv/GHSA-rr7j-v2q5-chgv","severity":"medium","message":"langsmith@0.1.68 (npm) is affected by GHSA-rr7j-v2q5-chgv","path":"collector/yarn.lock","line":null,"fingerprint":"langsmith@0.1.68 (npm):GHSA-rr7j-v2q5-chgv"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash@4.17.21 (npm) is affected by GHSA-xxjr-mmjv-4gpg; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-7gmj-h9xc-mcxc","severity":"medium","message":"mailparser@3.9.0 (npm) is affected by GHSA-7gmj-h9xc-mcxc","path":"collector/yarn.lock","line":null,"fingerprint":"mailparser@3.9.0 (npm):GHSA-7gmj-h9xc-mcxc"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.5 (npm) is affected by GHSA-g3hv-75wg-m249; also in frontend/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-4p3w-j4w9-5jqw","severity":"medium","message":"moment@2.30.1 (npm) is affected by GHSA-4p3w-j4w9-5jqw; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"moment@2.30.1 (npm):GHSA-4p3w-j4w9-5jqw"},{"rule_id":"osv/GHSA-268h-hp4c-crq3","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-268h-hp4c-crq3","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-268h-hp4c-crq3"},{"rule_id":"osv/GHSA-39m8-27wv-hr27","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-39m8-27wv-hr27","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-39m8-27wv-hr27"},{"rule_id":"osv/GHSA-4ffr-jq9g-5ffx","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-4ffr-jq9g-5ffx","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-4ffr-jq9g-5ffx"},{"rule_id":"osv/GHSA-4g23-2xm8-66gc","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-4g23-2xm8-66gc","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-4g23-2xm8-66gc"},{"rule_id":"osv/GHSA-6vj9-mwq6-2f5v","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-6vj9-mwq6-2f5v","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-6vj9-mwq6-2f5v"},{"rule_id":"osv/GHSA-85x2-q946-cp5h","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-85x2-q946-cp5h","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-85x2-q946-cp5h"},{"rule_id":"osv/GHSA-8c8m-p3m8-cjg8","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-8c8m-p3m8-cjg8","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-8c8m-p3m8-cjg8"},{"rule_id":"osv/GHSA-8m3c-c648-2xjj","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-8m3c-c648-2xjj","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-8m3c-c648-2xjj"},{"rule_id":"osv/GHSA-8vvx-rff5-p5rq","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-8vvx-rff5-p5rq","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-8vvx-rff5-p5rq"},{"rule_id":"osv/GHSA-cc9r-2j5m-2m83","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-cc9r-2j5m-2m83","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-cc9r-2j5m-2m83"},{"rule_id":"osv/GHSA-g73g-hqqh-jr95","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-g73g-hqqh-jr95","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-g73g-hqqh-jr95"},{"rule_id":"osv/GHSA-m943-m63m-w62w","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-m943-m63m-w62w","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-m943-m63m-w62w"},{"rule_id":"osv/GHSA-vvjj-xcjg-gr5g","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-vvjj-xcjg-gr5g","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-vvjj-xcjg-gr5g"},{"rule_id":"osv/GHSA-wmmp-3585-3rmp","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-wmmp-3585-3rmp","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-wmmp-3585-3rmp"},{"rule_id":"osv/GHSA-wqvq-jvpq-h66f","severity":"medium","message":"nodemailer@7.0.10 (npm) is affected by GHSA-wqvq-jvpq-h66f","path":"collector/yarn.lock","line":null,"fingerprint":"nodemailer@7.0.10 (npm):GHSA-wqvq-jvpq-h66f"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p; also in frontend/yarn.lock; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-2pr8-phx7-x9h3","severity":"medium","message":"protobufjs@6.11.4 (npm) is affected by GHSA-2pr8-phx7-x9h3; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-2pr8-phx7-x9h3"},{"rule_id":"osv/GHSA-f38q-mgvj-vph7","severity":"medium","message":"protobufjs@6.11.4 (npm) is affected by GHSA-f38q-mgvj-vph7; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-f38q-mgvj-vph7"},{"rule_id":"osv/GHSA-fx83-v9x8-x52w","severity":"medium","message":"protobufjs@6.11.4 (npm) is affected by GHSA-fx83-v9x8-x52w; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-fx83-v9x8-x52w"},{"rule_id":"osv/GHSA-jggg-4jg4-v7c6","severity":"medium","message":"protobufjs@6.11.4 (npm) is affected by GHSA-jggg-4jg4-v7c6; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-jggg-4jg4-v7c6"},{"rule_id":"osv/GHSA-q6x5-8v7m-xcrf","severity":"medium","message":"protobufjs@6.11.4 (npm) is affected by GHSA-q6x5-8v7m-xcrf; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"protobufjs@6.11.4 (npm):GHSA-q6x5-8v7m-xcrf"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g; also in server/yarn.lock","path":"collector/yarn.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-4mjr-xmp4-gh2g"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":9.0,"findings":53.0,"findings_high":36.0,"findings_medium":17.0,"findings_low":0.0,"penalty":435.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-image-semver.yaml","line":20,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-image-semver.yaml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-image-semver.yaml","line":36,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-image-semver.yaml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-image-semver.yaml","line":67,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-image-semver.yaml:67"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/build-and-push-image-semver.yaml","line":36,"fingerprint":"cache-poisoning:.github/workflows/build-and-push-image-semver.yaml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-image.yaml","line":39,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-image.yaml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-image.yaml","line":55,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-image.yaml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-image.yaml","line":88,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-image.yaml:88"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/build-and-push-image.yaml","line":55,"fingerprint":"cache-poisoning:.github/workflows/build-and-push-image.yaml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-qa-tag.yaml","line":41,"fingerprint":"unpinned-uses:.github/workflows/build-qa-tag.yaml:41"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-qa-tag.yaml","line":44,"fingerprint":"unpinned-uses:.github/workflows/build-qa-tag.yaml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-qa-tag.yaml","line":49,"fingerprint":"unpinned-uses:.github/workflows/build-qa-tag.yaml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-qa-tag.yaml","line":59,"fingerprint":"unpinned-uses:.github/workflows/build-qa-tag.yaml:59"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/build-qa-tag.yaml","line":44,"fingerprint":"cache-poisoning:.github/workflows/build-qa-tag.yaml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/check-package-versions.yaml","line":23,"fingerprint":"unpinned-uses:.github/workflows/check-package-versions.yaml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/check-package-versions.yaml","line":26,"fingerprint":"unpinned-uses:.github/workflows/check-package-versions.yaml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/check-translations.yaml","line":23,"fingerprint":"unpinned-uses:.github/workflows/check-translations.yaml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/check-translations.yaml","line":26,"fingerprint":"unpinned-uses:.github/workflows/check-translations.yaml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":31,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":51,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:51"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":52,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":55,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":69,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:69"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":70,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:70"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":73,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:73"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":87,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:87"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":88,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:88"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yaml","line":91,"fingerprint":"unpinned-uses:.github/workflows/lint.yaml:91"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/run-tests.yaml","line":20,"fingerprint":"unpinned-uses:.github/workflows/run-tests.yaml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/run-tests.yaml","line":23,"fingerprint":"unpinned-uses:.github/workflows/run-tests.yaml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/run-tests.yaml","line":28,"fingerprint":"unpinned-uses:.github/workflows/run-tests.yaml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/run-tests.yaml","line":38,"fingerprint":"unpinned-uses:.github/workflows/run-tests.yaml:38"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/run-tests.yaml","line":48,"fingerprint":"unpinned-uses:.github/workflows/run-tests.yaml:48"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yaml","line":14,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yaml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yaml","line":18,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yaml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yaml","line":27,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yaml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yaml","line":34,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yaml:34"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-and-push-image-semver.yaml","line":19,"fingerprint":"artipacked:.github/workflows/build-and-push-image-semver.yaml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-and-push-image.yaml","line":38,"fingerprint":"artipacked:.github/workflows/build-and-push-image.yaml:38"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-qa-tag.yaml","line":40,"fingerprint":"artipacked:.github/workflows/build-qa-tag.yaml:40"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/check-package-versions.yaml","line":22,"fingerprint":"artipacked:.github/workflows/check-package-versions.yaml:22"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/check-package-versions.yaml","line":18,"fingerprint":"excessive-permissions:.github/workflows/check-package-versions.yaml:18"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/check-translations.yaml","line":22,"fingerprint":"artipacked:.github/workflows/check-translations.yaml:22"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/check-translations.yaml","line":18,"fingerprint":"excessive-permissions:.github/workflows/check-translations.yaml:18"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/lint.yaml","line":51,"fingerprint":"artipacked:.github/workflows/lint.yaml:51"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/lint.yaml","line":69,"fingerprint":"artipacked:.github/workflows/lint.yaml:69"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/lint.yaml","line":87,"fingerprint":"artipacked:.github/workflows/lint.yaml:87"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/lint.yaml","line":1,"fingerprint":"excessive-permissions:.github/workflows/lint.yaml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/lint.yaml","line":46,"fingerprint":"excessive-permissions:.github/workflows/lint.yaml:46"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/lint.yaml","line":64,"fingerprint":"excessive-permissions:.github/workflows/lint.yaml:64"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/lint.yaml","line":82,"fingerprint":"excessive-permissions:.github/workflows/lint.yaml:82"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/run-tests.yaml","line":19,"fingerprint":"artipacked:.github/workflows/run-tests.yaml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/run-tests.yaml","line":15,"fingerprint":"excessive-permissions:.github/workflows/run-tests.yaml:15"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/sponsors.yaml","line":13,"fingerprint":"artipacked:.github/workflows/sponsors.yaml:13"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.945,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":55.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v1.19.0 ships AnythingLLMDesktop-Arm64.AppImage (332 downloads)","ref":"AnythingLLMDesktop-Arm64.AppImage","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop-Arm64.AppImage","weight":0.0},{"kind":"binary-release-asset","description":"release v1.19.0 ships AnythingLLMDesktop-Arm64.exe (485 downloads)","ref":"AnythingLLMDesktop-Arm64.exe","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop-Arm64.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v1.19.0 ships AnythingLLMDesktop-Silicon.dmg (1100 downloads)","ref":"AnythingLLMDesktop-Silicon.dmg","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop-Silicon.dmg","weight":0.0},{"kind":"binary-release-asset","description":"release v1.19.0 ships AnythingLLMDesktop.AppImage (1496 downloads)","ref":"AnythingLLMDesktop.AppImage","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop.AppImage","weight":0.0},{"kind":"binary-release-asset","description":"release v1.19.0 ships AnythingLLMDesktop.dmg (343 downloads)","ref":"AnythingLLMDesktop.dmg","url":"https://github.com/Mintplex-Labs/anything-llm/releases/download/v1.19.0/AnythingLLMDesktop.dmg","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":11605.0,"function_nloc":140384.0,"mean_ccn":2.81,"p90_ccn":6.0,"complex_functions":142.0,"long_functions":118.0,"many_param_functions":2.0,"risky_nloc_share":0.1588},"findings":[],"evidence":[{"kind":"complex-function","description":"checkSetup in server/utils/agents/index.js: complexity 80, 185 lines","ref":"server/utils/agents/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/agents/index.js#L136","weight":1.0},{"kind":"complex-function","description":"providerDefault in server/utils/agents/index.js: complexity 79, 89 lines","ref":"server/utils/agents/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/agents/index.js#L330","weight":1.0},{"kind":"complex-function","description":"LangChainChatModel in server/utils/agents/aibitat/providers/ai-provider.js: complexity 69, 328 lines","ref":"server/utils/agents/aibitat/providers/ai-provider.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/agents/aibitat/providers/ai-provider.js#L253","weight":1.0},{"kind":"complex-function","description":"getCustomModels in server/utils/helpers/customModels.js: complexity 64, 139 lines","ref":"server/utils/helpers/customModels.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/helpers/customModels.js#L83","weight":1.0},{"kind":"complex-function","description":"reducer in frontend/src/components/Modals/ManageWorkspace/Documents/hooks/useDocumentPicker.js: complexity 62, 245 lines","ref":"frontend/src/components/Modals/ManageWorkspace/Documents/hooks/useDocumentPicker.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/frontend/src/components/Modals/ManageWorkspace/Documents/hooks/useDocumentPicker.js#L153","weight":1.0},{"kind":"complex-function","description":"renderChart in frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/Chartable/index.jsx: complexity 47, 247 lines","ref":"frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/Chartable/index.jsx","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/Chartable/index.jsx#L74","weight":0.7833333333333333},{"kind":"complex-function","description":"getLLMProviderConnector in server/utils/helpers/index.js: complexity 46, 133 lines","ref":"server/utils/helpers/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/helpers/index.js#L172","weight":0.7666666666666667},{"kind":"complex-function","description":"#buildProviderForConfig in server/utils/agents/aibitat/index.js: complexity 44, 127 lines","ref":"server/utils/agents/aibitat/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/agents/aibitat/index.js#L1471","weight":0.7333333333333333},{"kind":"complex-function","description":"getLLMProviderClass in server/utils/helpers/index.js: complexity 43, 128 lines","ref":"server/utils/helpers/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/helpers/index.js#L414","weight":0.7166666666666667},{"kind":"complex-function","description":"getBaseLLMProviderModel in server/utils/helpers/index.js: complexity 43, 84 lines","ref":"server/utils/helpers/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/server/utils/helpers/index.js#L548","weight":0.7166666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":210080.0,"duplicated_lines":36110.0,"duplicated_share":0.1719,"files":1241.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: cloud-deployments/openshift/docker-entrypoint.sh:13 and docker/docker-entrypoint.sh:3","ref":"cloud-deployments/openshift/docker-entrypoint.sh","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/cloud-deployments/openshift/docker-entrypoint.sh#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/eslint.config.mjs:11 and server/eslint.config.mjs:11","ref":"collector/eslint.config.mjs","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/eslint.config.mjs#L11","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/extensions/index.js:82 and collector/extensions/index.js:108","ref":"collector/extensions/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/extensions/index.js#L82","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/extensions/resync/index.js:27 and collector/extensions/resync/index.js:55","ref":"collector/extensions/resync/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/extensions/resync/index.js#L27","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/index.js:1 and server/index.js:1","ref":"collector/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/index.js#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/index.js:50 and collector/index.js:80","ref":"collector/index.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/index.js#L50","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/middleware/httpLogger.js:1 and server/middleware/httpLogger.js:1","ref":"collector/middleware/httpLogger.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/middleware/httpLogger.js#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/processLink/convert/generic.js:87 and collector/utils/extensions/WebsiteDepth/index.js:189","ref":"collector/processLink/convert/generic.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/processLink/convert/generic.js#L87","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/processSingleFile/convert/asAudio.js:2 and collector/processSingleFile/convert/asDocx.js:3","ref":"collector/processSingleFile/convert/asAudio.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/processSingleFile/convert/asAudio.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: collector/processSingleFile/convert/asAudio.js:47 and collector/processSingleFile/convert/asEPub.js:26","ref":"collector/processSingleFile/convert/asAudio.js","url":"https://github.com/Mintplex-Labs/anything-llm/blob/4d09fa5f730698d39f1d783e47316744b260a700/collector/processSingleFile/convert/asAudio.js#L47","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2014.0,"weighted_findings":1042.75,"scanned_lines":276248.0,"category:best-practice":602.0,"category:correctness":1412.0},"findings":[{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setIsCustomLogo(!isCustomLogo) instead?","path":"frontend/src/LogoContext.jsx","line":29,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/LogoContext.jsx:29"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setViewable(!viewable) instead?","path":"frontend/src/components/CanViewChatHistory/index.jsx","line":43,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/CanViewChatHistory/index.jsx:43"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setFooterData(!footerData) instead?","path":"frontend/src/components/Footer/index.jsx","line":40,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/Footer/index.jsx:40"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setModels(!models) instead?","path":"frontend/src/components/LLMSelection/AnthropicAiOptions/index.jsx","line":104,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/LLMSelection/AnthropicAiOptions/index.jsx:104"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setModels(!models) instead?","path":"frontend/src/components/LLMSelection/NvidiaNimOptions/remote.jsx","line":83,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/LLMSelection/NvidiaNimOptions/remote.jsx:83"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setModels(!models) instead?","path":"frontend/src/components/LLMSelection/PrivateModeOptions/index.jsx","line":28,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/LLMSelection/PrivateModeOptions/index.jsx:28"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setUser(!user) instead?","path":"frontend/src/components/Modals/Password/MultiUserAuth.jsx","line":202,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/Modals/Password/MultiUserAuth.jsx:202"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setToken(!token) instead?","path":"frontend/src/components/Modals/Password/MultiUserAuth.jsx","line":203,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/Modals/Password/MultiUserAuth.jsx:203"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setRecoveryCodes(!recoveryCodes) instead?","path":"frontend/src/components/Modals/Password/MultiUserAuth.jsx","line":206,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/Modals/Password/MultiUserAuth.jsx:206"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setToken(!token) instead?","path":"frontend/src/components/Modals/Password/SingleUserAuth.jsx","line":36,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/Modals/Password/SingleUserAuth.jsx:36"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setRecoveryCodes(!recoveryCodes) instead?","path":"frontend/src/components/Modals/Password/SingleUserAuth.jsx","line":38,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/Modals/Password/SingleUserAuth.jsx:38"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setThreads(!threads) instead?","path":"frontend/src/components/Sidebar/ActiveWorkspaces/ThreadContainer/index.jsx","line":68,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/components/Sidebar/ActiveWorkspaces/ThreadContainer/index.jsx:68"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setSaneDefaultSystemPrompt(!saneDefaultSystemPrompt) instead?","path":"frontend/src/pages/Admin/DefaultSystemPrompt/index.jsx","line":40,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/Admin/DefaultSystemPrompt/index.jsx:40"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/Admin/Invitations/NewInviteModal/index.jsx","line":35,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/Admin/Invitations/NewInviteModal/index.jsx:35"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/Admin/Users/NewUserModal/index.jsx","line":41,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/Admin/Users/NewUserModal/index.jsx:41"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/Admin/Users/UserRow/EditUserModal/index.jsx","line":58,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/Admin/Users/UserRow/EditUserModal/index.jsx:58"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/Admin/Workspaces/NewWorkspaceModal/index.jsx","line":22,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/Admin/Workspaces/NewWorkspaceModal/index.jsx:22"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/GeneralSettings/ApiKeys/NewApiKeyModal/index.jsx","line":37,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/GeneralSettings/ApiKeys/NewApiKeyModal/index.jsx:37"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/NewBrowserExtensionApiKeyModal/index.jsx","line":37,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/NewBrowserExtensionApiKeyModal/index.jsx:37"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/GeneralSettings/ChatEmbedWidgets/EmbedConfigs/EmbedRow/EditEmbedModal/index.jsx","line":36,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/GeneralSettings/ChatEmbedWidgets/EmbedConfigs/EmbedRow/EditEmbedModal/index.jsx:36"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/GeneralSettings/ChatEmbedWidgets/EmbedConfigs/NewEmbedModal/index.jsx","line":46,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/GeneralSettings/ChatEmbedWidgets/EmbedConfigs/NewEmbedModal/index.jsx:46"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/GeneralSettings/CommunityHub/ImportItem/Steps/PullAndReview/index.jsx","line":18,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/GeneralSettings/CommunityHub/ImportItem/Steps/PullAndReview/index.jsx:18"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setItem(!item) instead?","path":"frontend/src/pages/GeneralSettings/CommunityHub/ImportItem/Steps/PullAndReview/index.jsx","line":19,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/GeneralSettings/CommunityHub/ImportItem/Steps/PullAndReview/index.jsx:19"},{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead?","path":"frontend/src/pages/Invite/NewUserModal/index.jsx","line":44,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:frontend/src/pages/Invite/NewUserModal/index.jsx:44"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/index.js","line":103,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/index.js:103"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/index.js","line":128,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/index.js:128"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/index.js","line":152,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/index.js:152"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/index.js","line":180,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/index.js:180"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/index.js","line":228,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/index.js:228"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/resync/index.js","line":49,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/resync/index.js:49"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/resync/index.js","line":79,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/resync/index.js:79"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/resync/index.js","line":120,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/resync/index.js:120"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/resync/index.js","line":157,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/resync/index.js:157"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/resync/index.js","line":212,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/resync/index.js:212"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/resync/index.js","line":245,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/resync/index.js:245"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/extensions/resync/index.js","line":280,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/extensions/resync/index.js:280"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/processSingleFile/index.js","line":83,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/processSingleFile/index.js:83"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/OCRLoader/index.js","line":111,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/OCRLoader/index.js:111"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/OCRLoader/index.js","line":237,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/OCRLoader/index.js:237"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/WhisperProviders/GenericOpenAiWhisper.js","line":5,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/WhisperProviders/GenericOpenAiWhisper.js:5"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/WhisperProviders/OpenAiWhisper.js","line":5,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/WhisperProviders/OpenAiWhisper.js:5"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/WhisperProviders/localWhisper.js","line":66,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/WhisperProviders/localWhisper.js:66"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/WhisperProviders/localWhisper.js","line":67,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/WhisperProviders/localWhisper.js:67"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/downloadURIToFile/index.js","line":56,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/downloadURIToFile/index.js:56"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/downloadURIToFile/index.js","line":64,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/downloadURIToFile/index.js:64"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/DrupalWiki/DrupalWiki/index.js","line":335,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:335"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/GithubRepo/RepoLoader/index.js","line":179,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/GithubRepo/RepoLoader/index.js:179"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":11,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:11"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":14,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:14"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":17,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:17"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":20,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:20"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":34,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:34"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":37,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:37"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":40,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:40"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/RepoLoader/index.js","line":43,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/RepoLoader/index.js:43"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"collector/utils/extensions/YoutubeTranscript/YoutubeLoader/index.js","line":67,"fingerprint":"javascript.lang.best-practice.lazy-load-module:collector/utils/extensions/YoutubeTranscript/YoutubeLoader/index.js:67"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"frontend/src/components/WorkspaceChat/ChatContainer/PromptInput/SpeechToText/BrowserNative/index.jsx","line":33,"fingerprint":"javascript.lang.best-practice.javascript-alert:frontend/src/components/WorkspaceChat/ChatContainer/PromptInput/SpeechToText/BrowserNative/index.jsx:33"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"frontend/src/hooks/useWebPushNotifications.js","line":74,"fingerprint":"javascript.lang.best-practice.javascript-confirm:frontend/src/hooks/useWebPushNotifications.js:74"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"frontend/src/utils/keyboardShortcuts.js","line":76,"fingerprint":"javascript.lang.correctness.no-replaceall:frontend/src/utils/keyboardShortcuts.js:76"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":390,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:390"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":393,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:393"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":396,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:396"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":400,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:400"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":403,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:403"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":407,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:407"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":410,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:410"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":414,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:414"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":417,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:417"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":420,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:420"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":423,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:423"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":426,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:426"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":429,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:429"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":432,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:432"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":435,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:435"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":438,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:438"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":441,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:441"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":445,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:445"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":449,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:449"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":453,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:453"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/endpoints/admin.js","line":456,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/endpoints/admin.js:456"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/agentFileServer.js","line":102,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/agentFileServer.js:102"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/agentFileServer.js","line":103,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/agentFileServer.js:103"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/agentFileServer.js","line":107,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/agentFileServer.js:107"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/agentSkillWhitelist.js","line":17,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/agentSkillWhitelist.js:17"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/agentSkillWhitelist.js","line":35,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/agentSkillWhitelist.js:35"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/api/document/index.js","line":1283,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/api/document/index.js:1283"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/api/openai/index.js","line":250,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/api/openai/index.js:250"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/api/openai/index.js","line":282,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/api/openai/index.js:282"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/system.js","line":207,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/system.js:207"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/system.js","line":1571,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/system.js:1571"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/system.js","line":1603,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/system.js:1603"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":48,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:48"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":49,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:49"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":50,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:50"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":89,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:89"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":94,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:94"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":97,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:97"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":104,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:104"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":120,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:120"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils.js","line":276,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils.js:276"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils/outlookAgentUtils.js","line":35,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils/outlookAgentUtils.js:35"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils/outlookAgentUtils.js","line":109,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils/outlookAgentUtils.js:109"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils/outlookAgentUtils.js","line":139,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils/outlookAgentUtils.js:139"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils/outlookAgentUtils.js","line":177,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils/outlookAgentUtils.js:177"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/utils/outlookAgentUtils.js","line":178,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/utils/outlookAgentUtils.js:178"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/workspaces.js","line":259,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/workspaces.js:259"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/workspaces.js","line":1045,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/workspaces.js:1045"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/endpoints/workspaces.js","line":1081,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/endpoints/workspaces.js:1081"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/jobs/helpers/scheduled-job-helper.js","line":86,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/jobs/helpers/scheduled-job-helper.js:86"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/apiKeys.js","line":8,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/apiKeys.js:8"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/apiKeys.js","line":76,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/apiKeys.js:76"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/browserExtensionApiKey.js","line":13,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/browserExtensionApiKey.js:13"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/communityHub.js","line":77,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/communityHub.js:77"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/communityHub.js","line":116,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/communityHub.js:116"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/communityHub.js","line":126,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/communityHub.js:126"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/communityHub.js","line":127,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/communityHub.js:127"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documentSyncQueue.js","line":93,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documentSyncQueue.js:93"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documentSyncQueue.js","line":133,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documentSyncQueue.js:133"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documentSyncQueue.js","line":251,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documentSyncQueue.js:251"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documents.js","line":89,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documents.js:89"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documents.js","line":90,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documents.js:90"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documents.js","line":210,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documents.js:210"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documents.js","line":338,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documents.js:338"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documents.js","line":343,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documents.js:343"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/documents.js","line":393,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/documents.js:393"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/eventLogs.js","line":85,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/eventLogs.js:85"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/invite.js","line":6,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/invite.js:6"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/invite.js","line":53,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/invite.js:53"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/invite.js","line":54,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/invite.js:54"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/invite.js","line":121,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/invite.js:121"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/modelRouter.js","line":44,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/modelRouter.js:44"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/models/scheduledJob.js","line":114,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/models/scheduledJob.js:114"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/models/scheduledJob.js","line":114,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/models/scheduledJob.js:114"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"server/models/scheduledJob.js","line":116,"fingerprint":"javascript.lang.correctness.no-stringify-keys:server/models/scheduledJob.js:116"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":285,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:285"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":286,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:286"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":287,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:287"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":288,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:288"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":291,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:291"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":294,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:294"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":297,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:297"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJob.js","line":300,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJob.js:300"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJobRun.js","line":331,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJobRun.js:331"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJobRun.js","line":332,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJobRun.js:332"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJobRun.js","line":333,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJobRun.js:333"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/scheduledJobRun.js","line":334,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/scheduledJobRun.js:334"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":127,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:127"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":142,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:142"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":203,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:203"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":224,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:224"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":274,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:274"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":313,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:313"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":356,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:356"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":463,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:463"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":466,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:466"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":467,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:467"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":824,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:824"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":845,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:845"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/systemSettings.js","line":1083,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/systemSettings.js:1083"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/telemetry.js","line":51,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/telemetry.js:51"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/temporaryAuthToken.js","line":15,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/temporaryAuthToken.js:15"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/user.js","line":124,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/user.js:124"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/user.js","line":197,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/user.js:197"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/user.js","line":341,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/user.js:341"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/user.js","line":380,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/user.js:380"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/user.js","line":384,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/user.js:384"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspace.js","line":338,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspace.js:338"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspace.js","line":356,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspace.js:356"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspace.js","line":538,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspace.js:538"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspace.js","line":539,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspace.js:539"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspace.js","line":668,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspace.js:668"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspace.js","line":669,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspace.js:669"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspace.js","line":679,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspace.js:679"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspaceChats.js","line":244,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspaceChats.js:244"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspaceChats.js","line":245,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspaceChats.js:245"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspaceThread.js","line":94,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspaceThread.js:94"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/models/workspaceThread.js","line":159,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/models/workspaceThread.js:159"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/swagger/utils.js","line":29,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/swagger/utils.js:29"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/swagger/utils.js","line":43,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/swagger/utils.js:43"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/anthropic/index.js","line":34,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/anthropic/index.js:34"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/anthropic/index.js","line":100,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/anthropic/index.js:100"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/anthropic/index.js","line":411,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/anthropic/index.js:411"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/apipie/index.js","line":30,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/apipie/index.js:30"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/apipie/index.js","line":337,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/apipie/index.js:337"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/azureOpenAi/index.js","line":15,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/azureOpenAi/index.js:15"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/azureOpenAi/index.js","line":241,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/azureOpenAi/index.js:241"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/bedrock/index.js","line":103,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/bedrock/index.js:103"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/bedrock/index.js","line":437,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/bedrock/index.js:437"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/cerebras/index.js","line":17,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/cerebras/index.js:17"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/cerebras/index.js","line":296,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/cerebras/index.js:296"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/cohere/index.js","line":16,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/cohere/index.js:16"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/cohere/index.js","line":203,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/cohere/index.js:203"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/cometapi/index.js","line":31,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/cometapi/index.js:31"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/cometapi/index.js","line":385,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/cometapi/index.js:385"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/deepseek/index.js","line":23,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/deepseek/index.js:23"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/deepseek/index.js","line":228,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/deepseek/index.js:228"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/embeddedLemonade/config.js","line":46,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/embeddedLemonade/config.js:46"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/embeddedLemonade/config.js","line":160,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/embeddedLemonade/config.js:160"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/embeddedLemonade/endpoints.js","line":22,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/embeddedLemonade/endpoints.js:22"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"server/utils/AiProviders/embeddedLemonade/endpoints.js","line":23,"fingerprint":"javascript.lang.best-practice.lazy-load-module:server/utils/AiProviders/embeddedLemonade/endpoints.js:23"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1979,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":27393.0,"source_lines":276822.0,"test_ratio":0.099,"ci_files":9.0,"cochange_share":0.3204,"cochange_commits":284.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build-and-push-image-semver.yaml","ref":".github/workflows/build-and-push-image-semver.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/build-and-push-image.yaml","ref":".github/workflows/build-and-push-image.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/build-qa-tag.yaml","ref":".github/workflows/build-qa-tag.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/check-package-versions.yaml","ref":".github/workflows/check-package-versions.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/check-translations.yaml","ref":".github/workflows/check-translations.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/cleanup-qa-tag.yaml","ref":".github/workflows/cleanup-qa-tag.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/lint.yaml","ref":".github/workflows/lint.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/run-tests.yaml","ref":".github/workflows/run-tests.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/sponsors.yaml","ref":".github/workflows/sponsors.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (yarn test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (eslint)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["yarn test"],"lint_commands":["eslint"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":249.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2782.0,"other_lines":274040.0,"files_blamed":1241.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":200.0,"quality:other_per_kloc":0.73,"quality:ratio":0.0,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":300.0,"security:other_per_kloc":1.095,"security:ratio":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}