{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:01.341629Z","repo":{"ref":{"host":"github.com","owner":"Percona-Lab","name":"IBEX"},"default_branch":"main","clone_url":"https://github.com/Percona-Lab/IBEX.git","html_url":"https://github.com/Percona-Lab/IBEX","description":"IBEX (Integration Bridge for EXtended systems) — MCP server connecting AI assistants to Slack, Notion, Jira, ServiceNow, Salesforce, and persistent memory","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":766,"primary_language":"JavaScript","license_spdx":null,"created_at":"2026-03-03T16:53:28Z","pushed_at":"2026-06-20T03:23:38Z","security_policy_url":null,"distribution":{"owner_created_at":"2015-06-10T05:43:18Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"297c23cb32bda43e80e843271476d0ef5a80a7c4","profile":{"lines_by_language":{"JavaScript":5172,"Shell":983,"PowerShell":99},"files_by_category":{"source":31,"binary":10,"other":4,"config":2,"docs":2,"generated":1},"source_lines":6254,"test_lines":0},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":0.0,"style_index":0.24},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":33.3,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":36.9,"duplication":56.3,"lint":56.6,"testing":0.0,"docs":40.0,"type_safety":null,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 33% of function code in complex or long functions; 10% duplicated lines. Weakest area: testing."},"security":{"score":49.3,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":34.8,"dependencies":25.1,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 81 known vulnerabilities in 12 dependencies; 12 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":4.0,"checked":4.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":136.0,"attributed_commits":136.0,"attributed_commit_share":1.0,"effective_loc":10191.0,"attributed_loc":10191.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 136 attributed commits, 10,191 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"297c23cb32bda43e80e843271476d0ef5a80a7c4","url":"https://github.com/Percona-Lab/IBEX/commit/297c23cb32bda43e80e843271476d0ef5a80a7c4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"18ee9aeaa62afefda5d85e084ae99bfd56b95985","url":"https://github.com/Percona-Lab/IBEX/commit/18ee9aeaa62afefda5d85e084ae99bfd56b95985","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5239e60d7995ae779665687afdd300ecbd3e3a25","url":"https://github.com/Percona-Lab/IBEX/commit/5239e60d7995ae779665687afdd300ecbd3e3a25","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"39a6857bd6edf6aba333a53867ba4eba65975e50","url":"https://github.com/Percona-Lab/IBEX/commit/39a6857bd6edf6aba333a53867ba4eba65975e50","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"69083d16178810990b72ce18d76758e9e22b3c00","url":"https://github.com/Percona-Lab/IBEX/commit/69083d16178810990b72ce18d76758e9e22b3c00","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"31c579b527443ef98d55e9aae5f2cbde27785346","url":"https://github.com/Percona-Lab/IBEX/commit/31c579b527443ef98d55e9aae5f2cbde27785346","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c891ede27e2c0e6e5bb5d60d2d63cdedaf43b87a","url":"https://github.com/Percona-Lab/IBEX/commit/c891ede27e2c0e6e5bb5d60d2d63cdedaf43b87a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3e137b27abb14cca27a46325277da6377ec86384","url":"https://github.com/Percona-Lab/IBEX/commit/3e137b27abb14cca27a46325277da6377ec86384","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"95ebe38f626e3b7e02e2c181bde6b8da2228ce38","url":"https://github.com/Percona-Lab/IBEX/commit/95ebe38f626e3b7e02e2c181bde6b8da2228ce38","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a65b59d19646ee576ceb49b53d79f487f4e70174","url":"https://github.com/Percona-Lab/IBEX/commit/a65b59d19646ee576ceb49b53d79f487f4e70174","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"99eededb4319030ffe719b00109c1d42d352ea2c","url":"https://github.com/Percona-Lab/IBEX/commit/99eededb4319030ffe719b00109c1d42d352ea2c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3ceaac68c5e6afff0e482db3f68e08dcfc21be29","url":"https://github.com/Percona-Lab/IBEX/commit/3ceaac68c5e6afff0e482db3f68e08dcfc21be29","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9671f21d2b3e39d8e8b9b2664c948c6e85d28647","url":"https://github.com/Percona-Lab/IBEX/commit/9671f21d2b3e39d8e8b9b2664c948c6e85d28647","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e18317efa3d103bf5bcdd05dd0eec4fa12d1c592","url":"https://github.com/Percona-Lab/IBEX/commit/e18317efa3d103bf5bcdd05dd0eec4fa12d1c592","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f96f312d8d8d68bd630021e35383976dafc4978e","url":"https://github.com/Percona-Lab/IBEX/commit/f96f312d8d8d68bd630021e35383976dafc4978e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c43ecee33649cb56f43338004a5f4f7eace6ce92","url":"https://github.com/Percona-Lab/IBEX/commit/c43ecee33649cb56f43338004a5f4f7eace6ce92","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"cc92c00d5f1e273c517cd22ed719d6e9e1689ea6","url":"https://github.com/Percona-Lab/IBEX/commit/cc92c00d5f1e273c517cd22ed719d6e9e1689ea6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2b18941f56f24962868f5d81c296dee8a210a149","url":"https://github.com/Percona-Lab/IBEX/commit/2b18941f56f24962868f5d81c296dee8a210a149","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"cf3c200a849c1d0a7f9a2ff6435cc287434b03f9","url":"https://github.com/Percona-Lab/IBEX/commit/cf3c200a849c1d0a7f9a2ff6435cc287434b03f9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d253a0967b1af4589cf47eff50cd96cdadf1a605","url":"https://github.com/Percona-Lab/IBEX/commit/d253a0967b1af4589cf47eff50cd96cdadf1a605","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1c474d947d9f01b109ec5a8a63ab1af8af32c140","url":"https://github.com/Percona-Lab/IBEX/commit/1c474d947d9f01b109ec5a8a63ab1af8af32c140","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"59bcffc2f2cb14ac590b5d7157cb1ce991982995","url":"https://github.com/Percona-Lab/IBEX/commit/59bcffc2f2cb14ac590b5d7157cb1ce991982995","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e30159a3062eb27a1319a2ca389fc48e21387449","url":"https://github.com/Percona-Lab/IBEX/commit/e30159a3062eb27a1319a2ca389fc48e21387449","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"93476a088861fafc9363fcefa98e0c08f0d4ee7c","url":"https://github.com/Percona-Lab/IBEX/commit/93476a088861fafc9363fcefa98e0c08f0d4ee7c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"589410ed0b083fdf8c46e122d3a338b072bfac88","url":"https://github.com/Percona-Lab/IBEX/commit/589410ed0b083fdf8c46e122d3a338b072bfac88","weight":0.9}],"data":{"attributed_loc_by_commit":{"acf13be96b177233b2304a73cc911216f8ab02aa":2374,"ae3ee11123b0489d0305b4275a9ab2d4c1ebafb8":0,"33c700c99a752818e4a680632fe61168ba1fe53b":0,"628df295f46d89752630665c0bca60da4c7f9c03":0,"9923a517a6946143cc56867670b19b46d8ad1094":1398,"431ad75425e249a7d9c5631218d69faa029e3715":11,"64d057f783fe94ac95f5dbf3a1afb09ca49609f0":0,"8fdc8822ecfabdc4a4168f292dfa735feed118ad":0,"726987cd421be69c12e0e1ab248447bb226ca879":0,"0992a3a54d0a44d05592b2419e11613e798bb329":29,"fc50cd65ada9d9dbf872c155c371f472d34c54bd":0,"a45987142ab00d151ed170a50b77b650273a8c0c":89,"3afff594e6e58eda3c8ea2875644af76d5b9937c":62,"a3651328be947bb4e8769d92ff8e57c692ed1f2d":11,"3ac2871c3bbf54ed6079f93b0c46a03388c483ab":65,"70e27feeb4da007cbda3c3653ab5fabfcc106b75":112,"b5f000827ce5ec954afcaaa7b7af8002bb8e28d3":1,"f26e2aba27f442027a015cb6e918934a2d7ab3af":3,"bfdc2efed1da4d359052459ccb6a6f8de6d41b2b":0,"9aaea4ef62873250828d806da2f7e3c70421a198":10,"7c6501d8d24c99dffff5b38042e02e1d8a16d0cc":172,"57d24817fb87e06b9fa0155570a9e914b3c8d899":36,"f6f3b672b7d841a1e94e057f5628aa46804fded3":10,"ea23b02946f2b98d1f1be28bc68cd71dc59ad790":3,"f90d74821d787c00618c54f68989a3cf0482ca2e":2,"87290ce0542f5f37f786575a3e580a245da5aa23":1,"f2a12e5091eaecbfb14b42a311a8a8199fb6b327":54,"cb4806ea8ce31f3d2529abe6a0d8bfe6d38dcdcc":1,"a0d407d5311fa1ec52df3947ae338bab4c49512f":122,"9821c38c29f81575a1ff96f6de435de819664506":54,"2f6934731ef6f724ef4a7f53a91705d16ca2dde3":151,"40fa36bfc89e0a9d4794a022429867e0e0813703":151,"624a63ed452d3e79750824d98d9c587523eaa69e":274,"84599035d733bd851aa79f792691742b4107a0f6":45,"a5835c2504899f933dfe6eaa07139796627a4591":353,"125f3ad25c0aec812e79486ace9efad58886806d":28,"9a82d5196308e1d9d8ae75200124c4bb86112430":0,"9e69c798e7344f9a218bca99104beddbd94718d4":2,"2763a01b9eb41921e61526beec354373558cfe7c":98,"0d5e17a9d1a9b1ff946ff8e18bd601ea55383332":26,"0f7acae44d4029194b884a5bf4f9f315540800db":43,"ecc29774343ad3c42c8bea8dd49c7c5db5e217a7":2,"b0b3a56ad39dee3521eef04c71bb248e2ad192f2":1,"304e525f3a10087e621b4d26218c42936d8efe3e":2,"bdb41d61ed6129cbffec655ad3c37825d14a9180":5,"babd7490063828803cb14494cfc725147447627d":54,"620d0ed2a19cddea113c9f74f8a5ad4666ae6f39":28,"f8e7be67c09c29585df9ad4eb7c1c0ea0b52e294":0,"97ef63cbc3f3acd30f0de7e239825ed841677491":2,"86d04ecd1eb8d2930bc6f9c75dad01289ed6f84c":3,"fd28b59a2c341667caf80aac26e1a0fcfa1b8d28":1,"4ec5518182f1ae905513e68e6e66371ba1e37f5d":41,"5f36227b917bf203005e812355707493e3501453":0,"83fa4c0ae4075f996db6905d657c432ff6b28326":1,"af2239b530852bbe44563a6f2276f8946d3b7687":73,"cd5f6d70cb5cef9790f93ed9596ccb54eafa6f89":1,"7b61fa1109fb0bcc36cc1692b49e2381ee286bab":25,"9ace1b3696a927e9ff3d512a1c65588b64a67567":8,"1a8d209013f8b5ed1434a647571dcc6ca4d265c9":51,"f7ba319a042c378e21f9f76ef7563ac152ccabb0":0,"61f1817e2af779900230ed18a1bf8fc1849a8509":0,"62cbc523b7dd5e5e8bb21fd3fcb8a5a63c4250fd":5,"202938629ef7c12c9df7d0ddb1af0f7c7e0a8fdf":21,"6adb05ac8419dd3f7e9061bfbf9692c0c73c279e":6,"6255f9efb31d6811c8106b888f437435cd2e0380":47,"4d670e8ffcb4021112c5d18f52ffd386496cdca6":124,"c6d494e7c68e44b47c306862a4fed9368f335789":744,"d0352bd72c0d1f11c58eeee623bbd47fef59d610":69,"dabdbb3c921300cc822340467580dd5050d8130c":18,"d527dc29e1f32eb8e53fcdeceb3127ace76ac6c1":553,"1e872d0658f552b14d8a7952912950167cd45696":0,"a3d696c6636407bda38fb004962c16d1318fb9bd":617,"a80aef818ef460373cd030c321b4aaf9efb75b8d":22,"037910427685eb178f3cf2c86f6bf7f0befc9930":7,"03f7f7a15a99d24990911289fc794b83973f1876":46,"2e6e5f50e8fae0368ade17ac44ffcf0c8d1cc1a4":59,"d9372f3b72bceed324aefaf337651a5ac459b839":96,"c02fd8645abc9f04a0b6ab1aebecbf662c317518":22,"1e549d2eb8bdfe7d4ecc2f0da0cf312ad5162390":17,"0f46cbe106b36fe6dca8e5edf2653f21d1fecb99":43,"3c733d8e6352a832eabf041a813b1ee30b8546e3":0,"5bf7374132b93f3f3359a2e4bca00cc329d87de7":0,"e7bcdbab5ae5b77b14a72206afad1a8abe46c5fd":0,"a0ba3b839407760f5e41e6d4b5f1f9a5ddb0c25e":145,"f58a429ef33907e2f4951792058689fd36a82356":1,"4e2549901ac58698fc82c9f0f5c925e61ad516e5":6,"af9c6252dd99c4f7c13ec145dab5e881bfe6e02c":0,"1fdabef4dd7f22fb7b9be9a90bad8622e88fb69f":356,"15003ca652a241c97c4d26d02adb866fab4b96d3":0,"343a3970c4ddc2b371d506abd2de336883f2b320":40,"8440847cd3bc3c76a4edee90db9c451370598d27":1,"5c32d9e67c7d186ad4558fba9f0760c738e3bd44":21,"665b64dd9f66f7a578d57af46a51835f9f5dd0bd":2,"4262f28b53b1880e52aad679c26198e306bef61e":9,"83a8fba24b9fa5132d440666c665e07115248b1a":194,"a904986ec4a7d5dc675796a46c31e4b660b1fd04":117,"d256b6936bcd759119d0ec2f0cde4ebbe044e279":9,"61412b09b2ffdb907f7adae7662e9b1bf190dd52":2,"b5acdebaeccf939f93d8542fc683a831af77885e":1,"049a7295cd1da748917bb9c91a11b0203502348e":4,"ef956bdaf330d0a825d9495e2da84e4c4773a7d7":1,"b7fe4c0b968707eed53f9a9dbe7d8c8c5998a6b4":72,"cb466fbdd5c6535448e6694bcadf50b4c2e05e7b":3,"7da742774dba22ddf23527c66337678b839ff411":45,"c35b1d5f651f9c67619373a7264ea14a20770bc8":46,"4e6f118fe81610066fe0e8e5bf107d4772466341":2,"f6247c18711c0a41d21a0527f8cb43823f2055ec":0,"b870d85233b89219262e3c9b065fd79523a66605":9,"5421a4edcebea57793424367a4b3e86eded41142":0,"882d9ae1c21dfe698c2de82d881344542e67371d":1,"df404c4c2304267a068064b73eb3fc83271896e1":1,"589410ed0b083fdf8c46e122d3a338b072bfac88":10,"93476a088861fafc9363fcefa98e0c08f0d4ee7c":119,"e30159a3062eb27a1319a2ca389fc48e21387449":4,"59bcffc2f2cb14ac590b5d7157cb1ce991982995":0,"1c474d947d9f01b109ec5a8a63ab1af8af32c140":26,"d253a0967b1af4589cf47eff50cd96cdadf1a605":31,"cf3c200a849c1d0a7f9a2ff6435cc287434b03f9":3,"2b18941f56f24962868f5d81c296dee8a210a149":16,"cc92c00d5f1e273c517cd22ed719d6e9e1689ea6":19,"c43ecee33649cb56f43338004a5f4f7eace6ce92":90,"f96f312d8d8d68bd630021e35383976dafc4978e":8,"e18317efa3d103bf5bcdd05dd0eec4fa12d1c592":23,"9671f21d2b3e39d8e8b9b2664c948c6e85d28647":10,"3ceaac68c5e6afff0e482db3f68e08dcfc21be29":0,"99eededb4319030ffe719b00109c1d42d352ea2c":4,"a65b59d19646ee576ceb49b53d79f487f4e70174":1,"95ebe38f626e3b7e02e2c181bde6b8da2228ce38":8,"3e137b27abb14cca27a46325277da6377ec86384":40,"c891ede27e2c0e6e5bb5d60d2d63cdedaf43b87a":39,"31c579b527443ef98d55e9aae5f2cbde27785346":9,"69083d16178810990b72ce18d76758e9e22b3c00":1,"39a6857bd6edf6aba333a53867ba4eba65975e50":36,"5239e60d7995ae779665687afdd300ecbd3e3a25":1,"18ee9aeaa62afefda5d85e084ae99bfd56b95985":0,"297c23cb32bda43e80e843271476d0ef5a80a7c4":0},"tools":{"claude-code":{"name":"Claude Code","commits":136,"loc":10191,"first_seen":1772556690,"last_seen":1775128376}},"monthly":{"2026-03":{"loc":10191,"attributed_loc":10191},"2026-04":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":26.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":7817.0,"flagged_loc":2063.0,"flagged_loc_share":0.2639119866956633,"max_loc_per_hour":808.6672473867595,"median_loc_per_hour":85.41991882610054,"pr_timed_units":0.0,"excluded_import_loc":2374.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,063 lines of first-party code in ~2.6h (809 lines/hour, 19 commit session)","ref":"4262f28b53b1880e52aad679c26198e306bef61e","url":"https://github.com/Percona-Lab/IBEX/commit/4262f28b53b1880e52aad679c26198e306bef61e","weight":0.24260017421602786}],"data":{"flagged_loc_by_commit":{"d527dc29e1f32eb8e53fcdeceb3127ace76ac6c1":553,"a3d696c6636407bda38fb004962c16d1318fb9bd":617,"a80aef818ef460373cd030c321b4aaf9efb75b8d":22,"037910427685eb178f3cf2c86f6bf7f0befc9930":7,"03f7f7a15a99d24990911289fc794b83973f1876":46,"2e6e5f50e8fae0368ade17ac44ffcf0c8d1cc1a4":59,"d9372f3b72bceed324aefaf337651a5ac459b839":96,"c02fd8645abc9f04a0b6ab1aebecbf662c317518":22,"1e549d2eb8bdfe7d4ecc2f0da0cf312ad5162390":17,"0f46cbe106b36fe6dca8e5edf2653f21d1fecb99":43,"a0ba3b839407760f5e41e6d4b5f1f9a5ddb0c25e":145,"f58a429ef33907e2f4951792058689fd36a82356":1,"4e2549901ac58698fc82c9f0f5c925e61ad516e5":6,"1fdabef4dd7f22fb7b9be9a90bad8622e88fb69f":356,"343a3970c4ddc2b371d506abd2de336883f2b320":40,"8440847cd3bc3c76a4edee90db9c451370598d27":1,"5c32d9e67c7d186ad4558fba9f0760c738e3bd44":21,"665b64dd9f66f7a578d57af46a51835f9f5dd0bd":2,"4262f28b53b1880e52aad679c26198e306bef61e":9},"excluded_import_commits":["acf13be96b177233b2304a73cc911216f8ab02aa"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":0.0,"flagged_releases":0.0,"max_loc_per_day":0.0},"findings":[],"evidence":[],"data":{"releases":[]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":6254.0,"index":0.24,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":3.0,"per_kloc:emoji_in_code":0.48,"files:emoji_in_code":2.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":51.0,"findings_high":12.0,"findings_medium":38.0,"findings_low":1.0,"weighted_findings":18.562,"scanned_lines":6155.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"install-node.cjs","line":28,"fingerprint":"javascript.lang.security.detect-child-process:install-node.cjs:28"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"install-node.cjs","line":34,"fingerprint":"javascript.lang.security.detect-child-process:install-node.cjs:34"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"install-node.cjs","line":38,"fingerprint":"javascript.lang.security.detect-child-process:install-node.cjs:38"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `envPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"install-node.cjs","line":430,"fingerprint":"javascript.lang.security.detect-child-process:install-node.cjs:430"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `url`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"install-node.cjs","line":566,"fingerprint":"javascript.lang.security.detect-child-process:install-node.cjs:566"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `url`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"install-node.cjs","line":568,"fingerprint":"javascript.lang.security.detect-child-process:install-node.cjs:568"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `url`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"install-node.cjs","line":570,"fingerprint":"javascript.lang.security.detect-child-process:install-node.cjs:570"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"start-ibex.cjs","line":31,"fingerprint":"javascript.lang.security.detect-child-process:start-ibex.cjs:31"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `url`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"start-ibex.cjs","line":76,"fingerprint":"javascript.lang.security.detect-child-process:start-ibex.cjs:76"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `url`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"start-ibex.cjs","line":78,"fingerprint":"javascript.lang.security.detect-child-process:start-ibex.cjs:78"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `url`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"start-ibex.cjs","line":80,"fingerprint":"javascript.lang.security.detect-child-process:start-ibex.cjs:80"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"start-ibex.cjs","line":213,"fingerprint":"javascript.lang.security.detect-child-process:start-ibex.cjs:213"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"install-ibex","line":56,"fingerprint":"bash.curl.security.curl-pipe-bash:install-ibex:56"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"install-ibex","line":61,"fingerprint":"bash.curl.security.curl-pipe-bash:install-ibex:61"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":356,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:356"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":356,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:356"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":358,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:358"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":358,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:358"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `envPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":388,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:388"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `envPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":389,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:389"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `envPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":425,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:425"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":534,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:534"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":535,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:535"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":536,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:536"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":536,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:536"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":542,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:542"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":543,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:543"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":595,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:595"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":596,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:596"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":598,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:598"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":600,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:600"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":600,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:600"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":601,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:601"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":618,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:618"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":619,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:619"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":620,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:620"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":621,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:621"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":623,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:623"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":628,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:628"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":660,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:660"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":660,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:660"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":685,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:685"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"install-node.cjs","line":835,"fingerprint":"javascript.lang.security.html-in-template-string:install-node.cjs:835"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `targetDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"install-node.cjs","line":839,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:install-node.cjs:839"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":839,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:839"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"install-node.cjs","line":862,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:install-node.cjs:862"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"install-node.cjs","line":874,"fingerprint":"javascript.lang.security.html-in-template-string:install-node.cjs:874"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"start-ibex.cjs","line":285,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:start-ibex.cjs:285"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"start-ibex.cjs","line":493,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:start-ibex.cjs:493"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"start-ibex.cjs","line":550,"fingerprint":"javascript.lang.security.html-in-template-string:start-ibex.cjs:550"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"notion_indexer.js","line":52,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:notion_indexer.js:52"}],"evidence":[],"data":{"rulesets":["javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":12.0,"vulnerabilities":81.0,"vulns_critical":1.0,"vulns_high":21.0,"vulns_medium":53.0,"vulns_low":6.0,"vulns_unknown":0.0,"penalty":83.0},"findings":[{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h","path":"package-lock.json","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.27.1 (npm) is affected by GHSA-22jm-h49p-29qw","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.27.1 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.27.1 (npm) is affected by GHSA-46jr-4wx8-v453","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.27.1 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.27.1 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.27.1 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.27.1 (npm) is affected by GHSA-f897-62hf-6gxq","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.27.1 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.2 (npm) is affected by GHSA-27r3-jxmh-p828","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-88fw-hqm2-52qc","severity":"high","message":"hono@4.12.9 (npm) is affected by GHSA-88fw-hqm2-52qc","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-88fw-hqm2-52qc"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.1.0 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.3.6 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.3.6 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-92pp-h63x-v22m","severity":"medium","message":"@hono/node-server@1.19.10 (npm) is affected by GHSA-92pp-h63x-v22m","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@1.19.10 (npm):GHSA-92pp-h63x-v22m"},{"rule_id":"osv/GHSA-frvp-7c67-39w9","severity":"medium","message":"@hono/node-server@1.19.10 (npm) is affected by GHSA-frvp-7c67-39w9","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@1.19.10 (npm):GHSA-frvp-7c67-39w9"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@1.19.10 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@1.19.10 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-rmxm-3fg6-px4f","severity":"medium","message":"@hono/node-server@1.19.10 (npm) is affected by GHSA-rmxm-3fg6-px4f","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@1.19.10 (npm):GHSA-rmxm-3fg6-px4f"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.27.1 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.27.1 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.27.1 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.27.1 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.3 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.3 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@10.5.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-26pp-8wgv-hjvm","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-26pp-8wgv-hjvm","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-26pp-8wgv-hjvm"},{"rule_id":"osv/GHSA-2gcr-mfcq-wcc3","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-2gcr-mfcq-wcc3","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-2gcr-mfcq-wcc3"},{"rule_id":"osv/GHSA-3hrh-pfw6-9m5x","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-3hrh-pfw6-9m5x","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-3hrh-pfw6-9m5x"},{"rule_id":"osv/GHSA-458j-xx4x-4375","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-458j-xx4x-4375","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-458j-xx4x-4375"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-46wx-v44x-9hh2","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-4h7h-rv7c-7m2v","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-4m76-xfj5-7975","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-54fx-42gc-7vw4","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-54fx-42gc-7vw4","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-54fx-42gc-7vw4"},{"rule_id":"osv/GHSA-5r4p-p66f-jhc7","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-5r4p-p66f-jhc7","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-5r4p-p66f-jhc7"},{"rule_id":"osv/GHSA-69xw-7hcm-h432","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-69xw-7hcm-h432","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-69xw-7hcm-h432"},{"rule_id":"osv/GHSA-8j4g-w8fx-2239","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-8j4g-w8fx-2239","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-8j4g-w8fx-2239"},{"rule_id":"osv/GHSA-9vqf-7f2p-gf9v","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-9vqf-7f2p-gf9v","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-9vqf-7f2p-gf9v"},{"rule_id":"osv/GHSA-crvj-82cr-hjcx","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-crvj-82cr-hjcx","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-crvj-82cr-hjcx"},{"rule_id":"osv/GHSA-f23p-vx2j-j53r","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-f23p-vx2j-j53r","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-f23p-vx2j-j53r"},{"rule_id":"osv/GHSA-f577-qrjj-4474","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-f577-qrjj-4474","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-f577-qrjj-4474"},{"rule_id":"osv/GHSA-g6gw-c38x-mqfc","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-g6gw-c38x-mqfc","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-g6gw-c38x-mqfc"},{"rule_id":"osv/GHSA-gqvv-2mrq-wpjv","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-gqvv-2mrq-wpjv","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-gqvv-2mrq-wpjv"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-h7mg-cq63-vhpq","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-hvrm-45r6-mjfj","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-hvrm-45r6-mjfj","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-hvrm-45r6-mjfj"},{"rule_id":"osv/GHSA-hxh3-vqpv-xpqv","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-hxh3-vqpv-xpqv","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-hxh3-vqpv-xpqv"},{"rule_id":"osv/GHSA-j6c9-x7qj-28xf","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-j6c9-x7qj-28xf","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-j6c9-x7qj-28xf"},{"rule_id":"osv/GHSA-p77w-8qqv-26rm","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-p77w-8qqv-26rm","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-p77w-8qqv-26rm"},{"rule_id":"osv/GHSA-qp7p-654g-cw7p","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-qp7p-654g-cw7p","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-qp7p-654g-cw7p"},{"rule_id":"osv/GHSA-r5rp-j6wh-rvv4","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-r5rp-j6wh-rvv4","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-r5rp-j6wh-rvv4"},{"rule_id":"osv/GHSA-rv63-4mwf-qqc2","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-rv63-4mwf-qqc2","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-rv63-4mwf-qqc2"},{"rule_id":"osv/GHSA-w62v-xxxg-mg59","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-w62v-xxxg-mg59","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-w62v-xxxg-mg59"},{"rule_id":"osv/GHSA-wgpf-jwqj-8h8p","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-wgpf-jwqj-8h8p","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-wgpf-jwqj-8h8p"},{"rule_id":"osv/GHSA-wmmm-f939-6g9c","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-wmmm-f939-6g9c","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-wmmm-f939-6g9c"},{"rule_id":"osv/GHSA-wwfh-h76j-fc44","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-wwfh-h76j-fc44","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-wwfh-h76j-fc44"},{"rule_id":"osv/GHSA-xf4j-xp2r-rqqx","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xf4j-xp2r-rqqx","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xf4j-xp2r-rqqx"},{"rule_id":"osv/GHSA-xgm2-5f3f-mvvc","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xgm2-5f3f-mvvc","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xgm2-5f3f-mvvc"},{"rule_id":"osv/GHSA-xpcf-pg52-r92g","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xpcf-pg52-r92g","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xpcf-pg52-r92g"},{"rule_id":"osv/GHSA-xrhx-7g5j-rcj5","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xrhx-7g5j-rcj5","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xrhx-7g5j-rcj5"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-v2v4-37r5-5v8g","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-x5fp-wj9c-mxmx","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-v422-hmwv-36x6","severity":"low","message":"body-parser@2.2.2 (npm) is affected by GHSA-v422-hmwv-36x6","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-v422-hmwv-36x6"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-333x-w4r6-6crp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.12.9 (npm) is affected by GHSA-3gg2-335m-rxc6","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-3gg2-335m-rxc6"},{"rule_id":"osv/GHSA-79qm-7rj5-m7r9","severity":"low","message":"hono@4.12.9 (npm) is affected by GHSA-79qm-7rj5-m7r9","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-79qm-7rj5-m7r9"},{"rule_id":"osv/GHSA-hm8q-7f3q-5f36","severity":"low","message":"hono@4.12.9 (npm) is affected by GHSA-hm8q-7f3q-5f36","path":"package-lock.json","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-hm8q-7f3q-5f36"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":273.0,"function_nloc":3766.0,"mean_ccn":3.74,"p90_ccn":8.0,"complex_functions":10.0,"long_functions":5.0,"many_param_functions":0.0,"risky_nloc_share":0.3327},"findings":[],"evidence":[{"kind":"complex-function","description":"main in start-ibex.cjs: complexity 49, 214 lines","ref":"start-ibex.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/start-ibex.cjs#L303","weight":0.8166666666666667},{"kind":"complex-function","description":"(anonymous) in server.js: complexity 36, 116 lines","ref":"server.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/server.js#L362","weight":0.6},{"kind":"complex-function","description":"main in scripts/configure-owui.cjs: complexity 34, 155 lines","ref":"scripts/configure-owui.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/scripts/configure-owui.cjs#L198","weight":0.5666666666666667},{"kind":"complex-function","description":"preflight in install-node.cjs: complexity 29, 94 lines","ref":"install-node.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/install-node.cjs#L240","weight":0.48333333333333334},{"kind":"complex-function","description":"setupLocalDomain in install-node.cjs: complexity 29, 67 lines","ref":"install-node.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/install-node.cjs#L607","weight":0.48333333333333334},{"kind":"complex-function","description":"buildSystemPrompt in scripts/configure-owui.cjs: complexity 23, 107 lines","ref":"scripts/configure-owui.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/scripts/configure-owui.cjs#L70","weight":0.38333333333333336},{"kind":"complex-function","description":"applyBranding in start-ibex.cjs: complexity 23, 80 lines","ref":"start-ibex.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/start-ibex.cjs#L102","weight":0.38333333333333336},{"kind":"complex-function","description":"promptCredentials in install-node.cjs: complexity 21, 76 lines","ref":"install-node.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/install-node.cjs#L437","weight":0.35},{"kind":"complex-function","description":"mapBlock in connectors/notion.js: complexity 18, 40 lines","ref":"connectors/notion.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/connectors/notion.js#L174","weight":0.3},{"kind":"complex-function","description":"main in notion_indexer.js: complexity 17, 77 lines","ref":"notion_indexer.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/notion_indexer.js#L284","weight":0.2833333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":4437.0,"duplicated_lines":424.0,"duplicated_share":0.0956,"files":31.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: connectors/jira.js:57 and connectors/jira.js:94","ref":"connectors/jira.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/connectors/jira.js#L57","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: connectors/notion.js:275 and notion_indexer.js:114","ref":"connectors/notion.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/connectors/notion.js#L275","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: connectors/salesforce.js:68 and connectors/salesforce.js:84","ref":"connectors/salesforce.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/connectors/salesforce.js#L68","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: connectors/slack.js:66 and connectors/slack.js:118","ref":"connectors/slack.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/connectors/slack.js#L66","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install-node.cjs:17 and start-ibex.cjs:19","ref":"install-node.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/install-node.cjs#L17","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install-node.cjs:390 and scripts/configure-owui.cjs:57","ref":"install-node.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/install-node.cjs#L390","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.js:4 and update.js:16","ref":"install.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/install.js#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/configure-owui.cjs:55 and start-ibex.cjs:41","ref":"scripts/configure-owui.cjs","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/scripts/configure-owui.cjs#L55","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: server.js:128 and servers/slack.js:15","ref":"server.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/server.js#L128","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: server.js:176 and servers/notion.js:14","ref":"server.js","url":"https://github.com/Percona-Lab/IBEX/blob/297c23cb32bda43e80e843271476d0ef5a80a7c4/server.js#L176","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":20.0,"weighted_findings":14.0,"scanned_lines":6155.0,"category:best-practice":11.0,"category:correctness":9.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":258,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:258"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":285,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:285"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":310,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:310"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":340,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:340"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":363,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:363"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":459,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:459"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":488,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:488"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":494,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:494"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"install-node.cjs","line":576,"fingerprint":"javascript.lang.best-practice.lazy-load-module:install-node.cjs:576"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"install-node.cjs","line":641,"fingerprint":"javascript.lang.best-practice.javascript-confirm:install-node.cjs:641"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"install-node.cjs","line":811,"fingerprint":"javascript.lang.best-practice.lazy-load-module:install-node.cjs:811"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/configure-owui.cjs","line":32,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/configure-owui.cjs:32"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"configure.sh","line":345,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:configure.sh:345"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"configure.sh","line":363,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:configure.sh:363"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"configure.sh","line":376,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:configure.sh:376"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"configure.sh","line":400,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:configure.sh:400"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"configure.sh","line":460,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:configure.sh:460"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/launchd-service.sh","line":110,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/launchd-service.sh:110"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/launchd-service.sh","line":123,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/launchd-service.sh:123"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/launchd-service.sh","line":135,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/launchd-service.sh:135"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":6254.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":112.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":175.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":6254.0,"other_lines":0.0,"files_blamed":31.0,"blame_failures":0.0,"quality:ai_findings":20.0,"quality:ai_per_kloc":3.198,"quality:other_findings":0.0,"security:ai_findings":49.0,"security:ai_per_kloc":7.835,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}