{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:01.329865Z","repo":{"ref":{"host":"github.com","owner":"PartialScience","name":"JSTC"},"default_branch":"main","clone_url":"https://github.com/PartialScience/JSTC.git","html_url":"https://github.com/PartialScience/JSTC","description":"Complete re-write and improvements on JavaTC using a modern tech stack ","stars":10,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":897,"primary_language":"Python","license_spdx":null,"created_at":"2025-11-09T18:07:36Z","pushed_at":"2026-10-24T15:18:05Z","security_policy_url":null,"distribution":{"owner_created_at":"2021-01-19T05:01:29Z","owner_type":"User","release_assets":[]}},"commit_sha":"ef6ececccea4fcf945c9db53a2d015a3fa4af552","profile":{"lines_by_language":{"TypeScript":17138,"Python":17117,"JavaScript":68},"files_by_category":{"source":164,"test":105,"config":16,"other":6,"docs":4,"generated":2},"source_lines":24298,"test_lines":10025},"pillars":{"ai_provenance":{"score":14.6,"confidence":0.88,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.1458,"suspected_share":0.1027,"estimated_share":0.1458,"ai_artifacts":0.0,"flagged_work_units":3.0,"flagged_releases":null,"style_index":0.041},"summary":"Explicit AI attribution on 15% of first-party code added; an estimated 15% including velocity signals."},"quality":{"score":67.2,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":77.6,"duplication":85.1,"lint":78.9,"testing":50.6,"docs":40.0,"type_safety":73.6,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.41, no CI test run detected; 8% of function code in complex or long functions; 3% duplicated lines. Weakest area: docs."},"security":{"score":61.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":97.4,"dependencies":6.5,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 58 known vulnerabilities in 21 dependencies; 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":53.0,"checked":53.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":73.0,"attributed_commits":11.0,"attributed_commit_share":0.1506849315068493,"effective_loc":42376.0,"attributed_loc":6180.0,"attributed_loc_share":0.14583726637719463,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 11 attributed commits, 6,180 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1b120f73740d5f2b42e40f96a50c2f5baee14a4f","url":"https://github.com/PartialScience/JSTC/commit/1b120f73740d5f2b42e40f96a50c2f5baee14a4f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b06c578fc9b86555b429fa745b3a903bcd0aca2b","url":"https://github.com/PartialScience/JSTC/commit/b06c578fc9b86555b429fa745b3a903bcd0aca2b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5ea60ed12e41855f955664851b9f86d92439f172","url":"https://github.com/PartialScience/JSTC/commit/5ea60ed12e41855f955664851b9f86d92439f172","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1da81bdba049e5e5d4aa25fbe15fb3ec24dce4a7","url":"https://github.com/PartialScience/JSTC/commit/1da81bdba049e5e5d4aa25fbe15fb3ec24dce4a7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2a95c59e3ba1b0d538e909f91a10d2bacef44be5","url":"https://github.com/PartialScience/JSTC/commit/2a95c59e3ba1b0d538e909f91a10d2bacef44be5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"04eec52dd5e5015cd30f7fe0f2252410efee89ee","url":"https://github.com/PartialScience/JSTC/commit/04eec52dd5e5015cd30f7fe0f2252410efee89ee","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d4310dd0702c6211330cdf0280b1f4dc8b8df6ff","url":"https://github.com/PartialScience/JSTC/commit/d4310dd0702c6211330cdf0280b1f4dc8b8df6ff","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"741e51e4f7ca3dcbd66e5333a910088ee123d9a0","url":"https://github.com/PartialScience/JSTC/commit/741e51e4f7ca3dcbd66e5333a910088ee123d9a0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"891e6399cca286f00b8257ce68fd74dac256e592","url":"https://github.com/PartialScience/JSTC/commit/891e6399cca286f00b8257ce68fd74dac256e592","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c29fd5ce044e1d976e8491962ff0be1ac92db2b4","url":"https://github.com/PartialScience/JSTC/commit/c29fd5ce044e1d976e8491962ff0be1ac92db2b4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"acb5b19e884e84e71446844dce183a49c406733c","url":"https://github.com/PartialScience/JSTC/commit/acb5b19e884e84e71446844dce183a49c406733c","weight":0.9}],"data":{"attributed_loc_by_commit":{"acb5b19e884e84e71446844dce183a49c406733c":77,"c29fd5ce044e1d976e8491962ff0be1ac92db2b4":2215,"891e6399cca286f00b8257ce68fd74dac256e592":223,"741e51e4f7ca3dcbd66e5333a910088ee123d9a0":132,"d4310dd0702c6211330cdf0280b1f4dc8b8df6ff":22,"04eec52dd5e5015cd30f7fe0f2252410efee89ee":227,"2a95c59e3ba1b0d538e909f91a10d2bacef44be5":518,"1da81bdba049e5e5d4aa25fbe15fb3ec24dce4a7":2189,"5ea60ed12e41855f955664851b9f86d92439f172":208,"b06c578fc9b86555b429fa745b3a903bcd0aca2b":63,"1b120f73740d5f2b42e40f96a50c2f5baee14a4f":306},"tools":{"claude-code":{"name":"Claude Code","commits":11,"loc":6180,"first_seen":1792601430,"last_seen":1792612504}},"monthly":{"2025-10":{"loc":593,"attributed_loc":0},"2025-11":{"loc":0,"attributed_loc":0},"2025-12":{"loc":14,"attributed_loc":0},"2026-01":{"loc":2051,"attributed_loc":0},"2026-02":{"loc":4158,"attributed_loc":0},"2026-03":{"loc":954,"attributed_loc":0},"2026-05":{"loc":0,"attributed_loc":0},"2026-07":{"loc":24635,"attributed_loc":0},"2026-08":{"loc":175,"attributed_loc":0},"2026-10":{"loc":9796,"attributed_loc":6180}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":31.0,"flagged_units":3.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":22420.0,"flagged_loc":9955.0,"flagged_loc_share":0.44402319357716324,"max_loc_per_hour":1074.1719032910853,"median_loc_per_hour":172.28106432446396,"pr_timed_units":0.0,"excluded_import_loc":19956.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"5,603 lines of first-party code in ~5.2h (1,074 lines/hour, 8 commit session)","ref":"1da81bdba049e5e5d4aa25fbe15fb3ec24dce4a7","url":"https://github.com/PartialScience/JSTC/commit/1da81bdba049e5e5d4aa25fbe15fb3ec24dce4a7","weight":0.32225157098732554},{"kind":"velocity-burst","description":"1,890 lines of first-party code in ~2.5h (759 lines/hour, 2 commit session)","ref":"9c82eeccfe9e07657f2187e50df6533b4461c15f","url":"https://github.com/PartialScience/JSTC/commit/9c82eeccfe9e07657f2187e50df6533b4461c15f","weight":0.2276092774308653},{"kind":"velocity-burst","description":"2,462 lines of first-party code in ~4.0h (616 lines/hour, 2 commit session)","ref":"51c805a08cf82bdb856606e098154daca5880b55","url":"https://github.com/PartialScience/JSTC/commit/51c805a08cf82bdb856606e098154daca5880b55","weight":0.18465}],"data":{"flagged_loc_by_commit":{"51c805a08cf82bdb856606e098154daca5880b55":1232,"fee35b63efbc8ef2f2ba82744958bf67278c281e":1230,"9c82eeccfe9e07657f2187e50df6533b4461c15f":945,"60b28d6043a520aaad33f00248ef40b6f30cbd42":945,"acb5b19e884e84e71446844dce183a49c406733c":77,"c29fd5ce044e1d976e8491962ff0be1ac92db2b4":2215,"891e6399cca286f00b8257ce68fd74dac256e592":223,"741e51e4f7ca3dcbd66e5333a910088ee123d9a0":132,"d4310dd0702c6211330cdf0280b1f4dc8b8df6ff":22,"04eec52dd5e5015cd30f7fe0f2252410efee89ee":227,"2a95c59e3ba1b0d538e909f91a10d2bacef44be5":518,"1da81bdba049e5e5d4aa25fbe15fb3ec24dce4a7":2189},"excluded_import_commits":["418e67741feb45c643fdd0a1343e5c3addfa0af1","5dc030c44af01a6af81882d57e5f05dddf02d3a2"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":24298.0,"index":0.041,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.041,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: *  first, so any real angle is accepted. */","ref":"frontend/src/field/phaseColor.ts:55","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/field/phaseColor.ts#L55","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"findings_high":1.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":1.8,"scanned_lines":24298.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":".devcontainer/Dockerfile","line":64,"fingerprint":"dockerfile.security.missing-user:.devcontainer/Dockerfile:64"}],"evidence":[],"data":{"rulesets":["typescript","javascript","python","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":21.0,"vulnerabilities":58.0,"vulns_critical":4.0,"vulns_high":32.0,"vulns_medium":18.0,"vulns_low":4.0,"vulns_unknown":0.0,"penalty":164.0},"findings":[{"rule_id":"osv/GHSA-5gmw-xhrv-c9v3","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3","path":"frontend/package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-5gmw-xhrv-c9v3"},{"rule_id":"osv/GHSA-85c8-ppgw-ccpr","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr","path":"frontend/package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-85c8-ppgw-ccpr"},{"rule_id":"osv/GHSA-5xrq-8626-4rwp","severity":"critical","message":"vitest@2.1.9 (npm) is affected by GHSA-5xrq-8626-4rwp","path":"frontend/package-lock.json","line":null,"fingerprint":"vitest@2.1.9 (npm):GHSA-5xrq-8626-4rwp"},{"rule_id":"osv/GHSA-pqg4-j6r4-53mv","severity":"critical","message":"shell-quote@1.8.4 (npm) is affected by GHSA-pqg4-j6r4-53mv","path":"package-lock.json","line":null,"fingerprint":"shell-quote@1.8.4 (npm):GHSA-pqg4-j6r4-53mv"},{"rule_id":"osv/PYSEC-2024-38","severity":"high","message":"fastapi@0.104.1 (PyPI) is affected by PYSEC-2024-38","path":"api/requirements.txt","line":null,"fingerprint":"fastapi@0.104.1 (PyPI):PYSEC-2024-38"},{"rule_id":"osv/GHSA-2jv5-9r88-3w3p","severity":"high","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-1850, GHSA-2jv5-9r88-3w3p","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-2jv5-9r88-3w3p"},{"rule_id":"osv/GHSA-59g5-xgcq-4qw3","severity":"high","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-1851, GHSA-59g5-xgcq-4qw3","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-59g5-xgcq-4qw3"},{"rule_id":"osv/GHSA-wp53-j4wj-2cfg","severity":"high","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-1852, GHSA-wp53-j4wj-2cfg","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-wp53-j4wj-2cfg"},{"rule_id":"osv/GHSA-5rvq-cxj2-64vf","severity":"high","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-3036, GHSA-5rvq-cxj2-64vf","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-5rvq-cxj2-64vf"},{"rule_id":"osv/GHSA-pp6c-gr5w-3c5g","severity":"high","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-3039, GHSA-pp6c-gr5w-3c5g","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-pp6c-gr5w-3c5g"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.5 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"frontend/package-lock.json","line":null,"fingerprint":"browserslist@4.28.5 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.5 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"frontend/package-lock.json","line":null,"fingerprint":"browserslist@4.28.5 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-px8p-9vwx-vf98","severity":"high","message":"fflate@0.6.10 (npm) is affected by GHSA-px8p-9vwx-vf98","path":"frontend/package-lock.json","line":null,"fingerprint":"fflate@0.6.10 (npm):GHSA-px8p-9vwx-vf98"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.2.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"frontend/package-lock.json","line":null,"fingerprint":"js-yaml@4.2.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.2.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"frontend/package-lock.json","line":null,"fingerprint":"js-yaml@4.2.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.2.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"frontend/package-lock.json","line":null,"fingerprint":"js-yaml@4.2.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.3.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"frontend/package-lock.json","line":null,"fingerprint":"js-yaml@4.3.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.3.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"frontend/package-lock.json","line":null,"fingerprint":"js-yaml@4.3.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.15 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"frontend/package-lock.json","line":null,"fingerprint":"nanoid@3.3.15 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.15 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"frontend/package-lock.json","line":null,"fingerprint":"nanoid@3.3.15 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.16 (npm) is affected by GHSA-r28c-9q8g-f849","path":"frontend/package-lock.json","line":null,"fingerprint":"postcss@8.5.16 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"frontend/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-395f-4hp3-45gv","severity":"high","message":"shell-quote@1.8.4 (npm) is affected by GHSA-395f-4hp3-45gv","path":"package-lock.json","line":null,"fingerprint":"shell-quote@1.8.4 (npm):GHSA-395f-4hp3-45gv"},{"rule_id":"osv/GHSA-6w46-j5rx-g56g","severity":"medium","message":"pytest@7.4.3 (PyPI) is affected by PYSEC-2026-1845, GHSA-6w46-j5rx-g56g","path":"api/requirements.txt","line":null,"fingerprint":"pytest@7.4.3 (PyPI):GHSA-6w46-j5rx-g56g"},{"rule_id":"osv/GHSA-mj87-hwqh-73pj","severity":"medium","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-3038, GHSA-mj87-hwqh-73pj","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-mj87-hwqh-73pj"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@2.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"frontend/package-lock.json","line":null,"fingerprint":"@vitest/mocker@2.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@2.1.9 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"frontend/package-lock.json","line":null,"fingerprint":"@vitest/mocker@2.1.9 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.10.42 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"frontend/package-lock.json","line":null,"fingerprint":"baseline-browser-mapping@2.10.42 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.21.5 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"frontend/package-lock.json","line":null,"fingerprint":"esbuild@0.21.5 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"frontend/package-lock.json","line":null,"fingerprint":"minimatch@10.2.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.16 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"frontend/package-lock.json","line":null,"fingerprint":"postcss@8.5.16 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@2.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"frontend/package-lock.json","line":null,"fingerprint":"vitest@2.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-6jv3-5f52-599m","severity":"low","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-3037, GHSA-6jv3-5f52-599m","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-6jv3-5f52-599m"},{"rule_id":"osv/GHSA-v9pg-7xvm-68hf","severity":"low","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-3040, GHSA-v9pg-7xvm-68hf","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-v9pg-7xvm-68hf"},{"rule_id":"osv/GHSA-vffw-93wf-4j4q","severity":"low","message":"python-multipart@0.0.6 (PyPI) is affected by PYSEC-2026-3041, GHSA-vffw-93wf-4j4q","path":"api/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.6 (PyPI):GHSA-vffw-93wf-4j4q"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@5.4.21 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.1233,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1508.0,"function_nloc":11950.0,"mean_ccn":2.22,"p90_ccn":5.0,"complex_functions":13.0,"long_functions":3.0,"many_param_functions":4.0,"risky_nloc_share":0.0846},"findings":[],"evidence":[{"kind":"complex-function","description":"gmsh_to_mfem in api/app/simulation/meshing/gmsh_to_mfem.py: complexity 37, 119 lines","ref":"api/app/simulation/meshing/gmsh_to_mfem.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/simulation/meshing/gmsh_to_mfem.py#L127","weight":0.6166666666666667},{"kind":"complex-function","description":"CoilCanvas in frontend/src/editor/CoilCanvas.tsx: complexity 25, 252 lines","ref":"frontend/src/editor/CoilCanvas.tsx","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/editor/CoilCanvas.tsx#L110","weight":0.4166666666666667},{"kind":"complex-function","description":"visualize_region in api/app/geometry/visualization/visualization.py: complexity 23, 64 lines","ref":"api/app/geometry/visualization/visualization.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/geometry/visualization/visualization.py#L45","weight":0.38333333333333336},{"kind":"complex-function","description":"reconstruct_from_spice in api/app/simulation/coupled/spice_export.py: complexity 23, 56 lines","ref":"api/app/simulation/coupled/spice_export.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/simulation/coupled/spice_export.py#L110","weight":0.38333333333333336},{"kind":"complex-function","description":"ContextMenu in frontend/src/ui/ContextMenu.tsx: complexity 23, 84 lines","ref":"frontend/src/ui/ContextMenu.tsx","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/ui/ContextMenu.tsx#L18","weight":0.38333333333333336},{"kind":"complex-function","description":"OperatingModePane in frontend/src/ui/OperatingMode.tsx: complexity 23, 120 lines","ref":"frontend/src/ui/OperatingMode.tsx","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/ui/OperatingMode.tsx#L115","weight":0.38333333333333336},{"kind":"complex-function","description":"scaleCoilLengths in frontend/src/state/coilFile.ts: complexity 22, 28 lines","ref":"frontend/src/state/coilFile.ts","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/state/coilFile.ts#L140","weight":0.36666666666666664},{"kind":"complex-function","description":"onTouchMove in frontend/src/editor/CoilCanvas.tsx: complexity 20, 55 lines","ref":"frontend/src/editor/CoilCanvas.tsx","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/editor/CoilCanvas.tsx#L538","weight":0.3333333333333333},{"kind":"complex-function","description":"onTouchEnd in frontend/src/editor/CoilCanvas.tsx: complexity 20, 46 lines","ref":"frontend/src/editor/CoilCanvas.tsx","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/editor/CoilCanvas.tsx#L600","weight":0.3333333333333333},{"kind":"complex-function","description":"onKeyDown in frontend/src/state/useEditorKeyboard.ts: complexity 19, 31 lines","ref":"frontend/src/state/useEditorKeyboard.ts","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/state/useEditorKeyboard.ts#L71","weight":0.31666666666666665}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":18032.0,"duplicated_lines":483.0,"duplicated_share":0.0268,"files":164.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/geometry/__init__.py:53 and api/app/geometry/curves/__init__.py:20","ref":"api/app/geometry/__init__.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/geometry/__init__.py#L53","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/geometry/curves/base.py:179 and api/app/geometry/curves/catmull_rom.py:255","ref":"api/app/geometry/curves/base.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/geometry/curves/base.py#L179","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/geometry/curves/catmull_rom.py:103 and api/app/geometry/curves/piecewise.py:113","ref":"api/app/geometry/curves/catmull_rom.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/geometry/curves/catmull_rom.py#L103","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/geometry/curves/catmull_rom.py:107 and api/app/geometry/curves/line_segment.py:32","ref":"api/app/geometry/curves/catmull_rom.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/geometry/curves/catmull_rom.py#L107","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/simulation/coupled/coupled_system.py:205 and api/app/simulation/coupled/coupled_system.py:269","ref":"api/app/simulation/coupled/coupled_system.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/simulation/coupled/coupled_system.py#L205","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/simulation/distributed_element_matrices/capacitance/fem_solver.py:103 and api/app/simulation/fields/electrostatic_basis.py:90","ref":"api/app/simulation/distributed_element_matrices/capacitance/fem_solver.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/simulation/distributed_element_matrices/capacitance/fem_solver.py#L103","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/simulation/distributed_element_matrices/capacitance/fem_solver.py:117 and api/app/simulation/electrostatics/coil_setup.py:57","ref":"api/app/simulation/distributed_element_matrices/capacitance/fem_solver.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/simulation/distributed_element_matrices/capacitance/fem_solver.py#L117","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/simulation/distributed_element_matrices/inductance/base.py:24 and api/app/simulation/distributed_element_matrices/inductance/base.py:39","ref":"api/app/simulation/distributed_element_matrices/inductance/base.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/simulation/distributed_element_matrices/inductance/base.py#L24","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: api/app/simulation/facade/coupled.py:43 and api/app/simulation/facade/field.py:63","ref":"api/app/simulation/facade/coupled.py","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/api/app/simulation/facade/coupled.py#L43","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/src/api/schema.ts:19 and frontend/src/api/schema.ts:181","ref":"frontend/src/api/schema.ts","url":"https://github.com/PartialScience/JSTC/blob/ef6ececccea4fcf945c9db53a2d015a3fa4af552/frontend/src/api/schema.ts#L19","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":24.0,"weighted_findings":23.0,"scanned_lines":24298.0,"category:best-practice":8.0,"category:correctness":4.0,"category:maintainability":12.0},"findings":[{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `node_idx` is defined inside a function but never used","path":"api/app/simulation/coupled/spice_export.py","line":125,"fingerprint":"python.lang.maintainability.useless-inner-function:api/app/simulation/coupled/spice_export.py:125"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":67,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:67"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":68,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:68"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":69,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:69"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":70,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:70"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":71,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:71"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":73,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:73"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":75,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:75"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":79,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:79"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":80,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:80"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":81,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:81"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"api/app/simulation/meshing/gmsh_to_mfem.py","line":82,"fingerprint":"python.lang.maintainability.return-not-in-function:api/app/simulation/meshing/gmsh_to_mfem.py:82"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/editor/shapes.tsx","line":258,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/editor/shapes.tsx:258"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/editor/shapes.tsx","line":325,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/editor/shapes.tsx:325"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/editor/shapes.tsx","line":464,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/editor/shapes.tsx:464"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/ui/OperatingMode.tsx","line":279,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/ui/OperatingMode.tsx:279"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/ui/OperatingMode.tsx","line":280,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/ui/OperatingMode.tsx:280"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/ui/OperatingMode.tsx","line":289,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/ui/OperatingMode.tsx:289"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/ui/OperatingMode.tsx","line":290,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/ui/OperatingMode.tsx:290"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/ui/Toolbar.tsx","line":29,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/ui/Toolbar.tsx:29"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/ui/ContextMenu.tsx","line":128,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/ui/ContextMenu.tsx:128"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/ui/ContextMenu.tsx","line":128,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/ui/ContextMenu.tsx:128"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/ui/ContextMenu.tsx","line":128,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/ui/ContextMenu.tsx:128"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/ui/ContextMenu.tsx","line":128,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/ui/ContextMenu.tsx:128"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8252,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":10025.0,"source_lines":24298.0,"test_ratio":0.4126,"ci_files":0.0,"cochange_share":0.6271,"cochange_commits":59.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":236.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.5596,"check:low_escape_density":1.0,"escapes":7.0,"escapes_per_kloc":0.289},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: frontend/tsconfig.app.json","ref":"frontend/tsconfig.app.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":4002.0,"other_lines":20296.0,"files_blamed":164.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":24.0,"quality:other_per_kloc":1.182,"quality:ratio":0.0,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}