{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:01.356881Z","repo":{"ref":{"host":"github.com","owner":"PetroProg","name":"AI-news"},"default_branch":"main","clone_url":"https://github.com/PetroProg/AI-news.git","html_url":"https://github.com/PetroProg/AI-news","description":"Self-hosted personal AI news aggregator powered by local LLMs (Ollama), PostgreSQL, Docker, and Telegram. Full assistance of AI","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":5255,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-07-08T11:06:00Z","pushed_at":"2026-11-08T19:41:54Z","security_policy_url":null,"distribution":{"owner_created_at":"2026-01-04T16:17:03Z","owner_type":"User","release_assets":[]}},"commit_sha":"4fe4003753918942382f867a24bc34fd74db2dce","profile":{"lines_by_language":{"Python":9377,"JavaScript":6957,"Shell":74,"SQL":12},"files_by_category":{"source":49,"docs":18,"binary":10,"other":6,"config":4},"source_lines":16420,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.4238,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":7.278},"summary":"Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence)."},"quality":{"score":37.6,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":18.6,"duplication":82.5,"lint":74.0,"testing":0.5,"docs":65.0,"type_safety":0.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 56% of function code in complex or long functions; 3% duplicated lines. Weakest area: type safety."},"security":{"score":53.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":23.5,"dependencies":52.2,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 63 known vulnerabilities in 4 dependencies; 67 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":20.0,"checked":20.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":177.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":31856.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-07":{"loc":0,"attributed_loc":0},"2026-08":{"loc":656,"attributed_loc":0},"2026-09":{"loc":9095,"attributed_loc":0},"2026-10":{"loc":7926,"attributed_loc":0},"2026-11":{"loc":14179,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":69.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":31856.0,"flagged_loc":13502.0,"flagged_loc_share":0.42384480160723254,"max_loc_per_hour":3065.7332071901606,"median_loc_per_hour":98.95287958115185,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"13,502 lines of first-party code in ~4.4h (3,066 lines/hour, 4 commit session)","ref":"085dfe8ade1bfe9f6b0f8018c7f2ed6f866a8cdd","url":"https://github.com/PetroProg/AI-news/commit/085dfe8ade1bfe9f6b0f8018c7f2ed6f866a8cdd","weight":0.6}],"data":{"flagged_loc_by_commit":{"f7fd06eaedb3efa0d4207ad043722debbd2a2efc":205,"a6893953be2fd0dcf922a1414ac8924e26de0a77":6529,"4ac91b820e7c71e6cda87235ee43c5450e39b5d9":6558,"085dfe8ade1bfe9f6b0f8018c7f2ed6f866a8cdd":210},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":16420.0,"index":7.278,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":239.0,"per_kloc:emoji_in_code":14.555,"files:emoji_in_code":10.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":133.0,"findings_high":67.0,"findings_medium":65.0,"findings_low":1.0,"weighted_findings":67.963,"scanned_lines":16408.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text","severity":"high","message":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]","path":"app/api.py","line":1960,"fingerprint":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text:app/api.py:1960"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":500,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:500"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `toast.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":500,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:500"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1114,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1114"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1114,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1114"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1213,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1213"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1213,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1213"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1363,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1363"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `bannerEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1363,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1363"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1560,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1560"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1560,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1560"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1590,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1590"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `banner.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1590,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1590"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1668,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1668"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1668,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1668"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1734,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1734"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1734,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1734"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1961,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1961"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1961,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1961"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1982,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:1982"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":1982,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:1982"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2072,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2072"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2072,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2072"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2710,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2710"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `optEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2710,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2710"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2746,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2746"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `fbEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2746,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2746"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2749,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2749"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `fbEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2749,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2749"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2793,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2793"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `optEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2793,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2793"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2829,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2829"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `fbEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2829,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2829"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2832,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2832"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `fbEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2832,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2832"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2889,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2889"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `optEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2889,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2889"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2925,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2925"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `fbEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2925,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2925"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2928,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:2928"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `fbEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":2928,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:2928"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":3393,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:3393"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":3393,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:3393"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":3859,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:3859"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":3859,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:3859"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4058,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:4058"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `card.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4058,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:4058"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4259,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:4259"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `cpuChart.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4259,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:4259"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4266,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:4266"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ramText.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4266,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:4266"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4277,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:4277"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ramChart.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4277,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:4277"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4284,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:4284"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `diskText.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4284,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:4284"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4288,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:4288"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `diskChart.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":4288,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:4288"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5300,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:5300"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `card.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5300,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:5300"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5419,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:5419"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `sBadge.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5419,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:5419"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5509,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:5509"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `listEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5509,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:5509"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5682,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:5682"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tableBody.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":5682,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:5682"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":6049,"fingerprint":"javascript.browser.security.insecure-document-method:web/js/app.js:6049"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tableBody.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/js/app.js","line":6049,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/js/app.js:6049"},{"rule_id":"opengrep/python.fastapi.security.wildcard-cors","severity":"medium","message":"CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided. [confidence medium]","path":"app/api.py","line":34,"fingerprint":"python.fastapi.security.wildcard-cors:app/api.py:34"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":500,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:500"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1142,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1142"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1218,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1218"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1228,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1228"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1232,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1232"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1240,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1240"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1363,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1363"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1413,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1413"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1508,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1508"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1531,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1531"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1534,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1534"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1620,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1620"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1635,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1635"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1648,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1648"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1670,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1670"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1695,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1695"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1697,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1697"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":1744,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:1744"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2003,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2003"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2007,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2007"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2022,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2022"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2024,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2024"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2710,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2710"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2746,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2746"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2749,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2749"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2793,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2793"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2829,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2829"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2832,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2832"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2889,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2889"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2925,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2925"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":2928,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:2928"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3402,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3402"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3890,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3890"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3939,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3939"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3940,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3940"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3966,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3966"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3967,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3967"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3969,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3969"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":3987,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:3987"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":4025,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:4025"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":4266,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:4266"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":4284,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:4284"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":4311,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:4311"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":4495,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:4495"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":4506,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:4506"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":4685,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:4685"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5142,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5142"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5149,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5149"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5150,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5150"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5154,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5154"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5158,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5158"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5161,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5161"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5171,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5171"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5179,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5179"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5182,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5182"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5207,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5207"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5219,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5219"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5284,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5284"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5291,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5291"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5330,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5330"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5419,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5419"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":5498,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:5498"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":6067,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:6067"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/js/app.js","line":6073,"fingerprint":"javascript.lang.security.html-in-template-string:web/js/app.js:6073"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"web/js/app.js","line":2690,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:web/js/app.js:2690"}],"evidence":[],"data":{"rulesets":["python","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":4.0,"vulnerabilities":63.0,"vulns_critical":6.0,"vulns_high":41.0,"vulns_medium":14.0,"vulns_low":0.0,"vulns_unknown":2.0,"penalty":39.0},"findings":[{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-3f63-hfp8-52jq","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-3f63-hfp8-52jq"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-44wm-f244-xhp3","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-44wm-f244-xhp3"},{"rule_id":"osv/GHSA-j7hp-h8jx-5ppr","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-j7hp-h8jx-5ppr"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/GHSA-qw2m-4pqf-rmpp","severity":"high","message":"curl-cffi@0.7.0 (PyPI) is affected by PYSEC-2026-2431, GHSA-qw2m-4pqf-rmpp","path":"requirements.txt","line":null,"fingerprint":"curl-cffi@0.7.0 (PyPI):GHSA-qw2m-4pqf-rmpp"},{"rule_id":"osv/GHSA-vfmq-68hx-4jfw","severity":"high","message":"lxml@5.2.2 (PyPI) is affected by PYSEC-2026-87, GHSA-vfmq-68hx-4jfw","path":"requirements.txt","line":null,"fingerprint":"lxml@5.2.2 (PyPI):GHSA-vfmq-68hx-4jfw"},{"rule_id":"osv/GHSA-c6mh-fpjc-4pr3","severity":"high","message":"yt-dlp@2024.8.0 (PyPI) is affected by PYSEC-2026-3430, GHSA-c6mh-fpjc-4pr3","path":"requirements.txt","line":null,"fingerprint":"yt-dlp@2024.8.0 (PyPI):GHSA-c6mh-fpjc-4pr3"},{"rule_id":"osv/GHSA-g3gw-q23r-pgqm","severity":"high","message":"yt-dlp@2024.8.0 (PyPI) is affected by PYSEC-2026-3432, GHSA-g3gw-q23r-pgqm","path":"requirements.txt","line":null,"fingerprint":"yt-dlp@2024.8.0 (PyPI):GHSA-g3gw-q23r-pgqm"},{"rule_id":"osv/GHSA-vx4q-3cr2-7cg2","severity":"high","message":"yt-dlp@2024.8.0 (PyPI) is affected by PYSEC-2026-3433, GHSA-vx4q-3cr2-7cg2","path":"requirements.txt","line":null,"fingerprint":"yt-dlp@2024.8.0 (PyPI):GHSA-vx4q-3cr2-7cg2"},{"rule_id":"osv/GHSA-6v4j-43gg-vj32","severity":"high","message":"yt-dlp@2024.8.0 (PyPI) is affected by PYSEC-2026-3622, GHSA-6v4j-43gg-vj32","path":"requirements.txt","line":null,"fingerprint":"yt-dlp@2024.8.0 (PyPI):GHSA-6v4j-43gg-vj32"},{"rule_id":"osv/GHSA-69qj-pvh9-c5wg","severity":"high","message":"yt-dlp@2024.8.0 (PyPI) is affected by GHSA-69qj-pvh9-c5wg","path":"requirements.txt","line":null,"fingerprint":"yt-dlp@2024.8.0 (PyPI):GHSA-69qj-pvh9-c5wg"},{"rule_id":"osv/PYSEC-2023-175","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2023-175","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):PYSEC-2023-175"},{"rule_id":"osv/GHSA-wjx4-4jcj-g98j","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-wjx4-4jcj-g98j"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-r73j-pqj5-w3x7","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-r73j-pqj5-w3x7"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-wqgw-9xfh-qf2g"},{"rule_id":"osv/GHSA-f7j3-774f-rfhj","severity":"medium","message":"yt-dlp@2024.8.0 (PyPI) is affected by PYSEC-2026-3431, GHSA-f7j3-774f-rfhj","path":"requirements.txt","line":null,"fingerprint":"yt-dlp@2024.8.0 (PyPI):GHSA-f7j3-774f-rfhj"}],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"links to file hosts or shorteners: t.me/","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":484.0,"function_nloc":12316.0,"mean_ccn":8.56,"p90_ccn":18.0,"complex_functions":60.0,"long_functions":22.0,"many_param_functions":1.0,"risky_nloc_share":0.5599},"findings":[],"evidence":[{"kind":"complex-function","description":"isArticleEligibleForDisplay in web/js/app.js: complexity 272, 186 lines","ref":"web/js/app.js","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/web/js/app.js#L3114","weight":1.0},{"kind":"complex-function","description":"get_news_feed in app/api.py: complexity 226, 278 lines","ref":"app/api.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/api.py#L1000","weight":1.0},{"kind":"complex-function","description":"summarize_pending_articles in app/services/summarizer.py: complexity 172, 284 lines","ref":"app/services/summarizer.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/services/summarizer.py#L133","weight":1.0},{"kind":"complex-function","description":"normalizeCategory in web/js/app.js: complexity 141, 134 lines","ref":"web/js/app.js","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/web/js/app.js#L733","weight":1.0},{"kind":"complex-function","description":"getDeviceTelemetryAndServices in web/js/app.js: complexity 80, 604 lines","ref":"web/js/app.js","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/web/js/app.js#L4448","weight":1.0},{"kind":"complex-function","description":"window.setDynamicCategory in web/js/app.js: complexity 71, 127 lines","ref":"web/js/app.js","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/web/js/app.js#L2968","weight":1.0},{"kind":"complex-function","description":"delete_category_news in app/api.py: complexity 59, 87 lines","ref":"app/api.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/api.py#L1368","weight":0.9833333333333333},{"kind":"complex-function","description":"getArticleImage in web/js/app.js: complexity 57, 34 lines","ref":"web/js/app.js","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/web/js/app.js#L962","weight":0.95},{"kind":"complex-function","description":"get_server_health in app/api.py: complexity 56, 207 lines","ref":"app/api.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/api.py#L2031","weight":0.9333333333333333},{"kind":"complex-function","description":"collect in app/collectors/instagram.py: complexity 54, 144 lines","ref":"app/collectors/instagram.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/collectors/instagram.py#L44","weight":0.9}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":12697.0,"duplicated_lines":406.0,"duplicated_share":0.032,"files":49.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: app/ai/client.py:100 and app/ai/client.py:125","ref":"app/ai/client.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/ai/client.py#L100","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api.py:62 and app/services/summarizer.py:27","ref":"app/api.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/api.py#L62","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api.py:170 and app/processing/deduplicator.py:17","ref":"app/api.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/api.py#L170","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api.py:1217 and scripts/apply_opinion_filter.py:97","ref":"app/api.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/api.py#L1217","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api.py:2733 and app/api.py:2760","ref":"app/api.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/api.py#L2733","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/bot/utils.py:140 and app/bot/utils.py:295","ref":"app/bot/utils.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/bot/utils.py#L140","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/services/processing.py:173 and app/services/processing.py:250","ref":"app/services/processing.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/services/processing.py#L173","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/services/summarizer.py:364 and scripts/apply_opinion_filter.py:45","ref":"app/services/summarizer.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/app/services/summarizer.py#L364","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/apply_opinion_filter.py:137 and web/js/app.js:3138","ref":"scripts/apply_opinion_filter.py","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/scripts/apply_opinion_filter.py#L137","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: web/js/app.js:1121 and web/js/app.js:3915","ref":"web/js/app.js","url":"https://github.com/PetroProg/AI-news/blob/4fe4003753918942382f867a24bc34fd74db2dce/web/js/app.js#L1121","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":23.0,"weighted_findings":19.75,"scanned_lines":16408.0,"category:best-practice":16.0,"category:correctness":7.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"app/bot/utils.py","line":73,"fingerprint":"python.lang.best-practice.arbitrary-sleep:app/bot/utils.py:73"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"app/api.py","line":1979,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:app/api.py:1979"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"app/api.py","line":1995,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:app/api.py:1995"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"app/api.py","line":2178,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:app/api.py:2178"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"app/api.py","line":2395,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:app/api.py:2395"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"app/api.py","line":2578,"fingerprint":"python.lang.best-practice.logging-error-without-handling:app/api.py:2578"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"app/api.py","line":2604,"fingerprint":"python.lang.best-practice.logging-error-without-handling:app/api.py:2604"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"app/api.py","line":2634,"fingerprint":"python.lang.best-practice.logging-error-without-handling:app/api.py:2634"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"app/api.py","line":2751,"fingerprint":"python.lang.best-practice.logging-error-without-handling:app/api.py:2751"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"app/api.py","line":2780,"fingerprint":"python.lang.best-practice.logging-error-without-handling:app/api.py:2780"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"app/services/battery_monitor.py","line":18,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:app/services/battery_monitor.py:18"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"app/services/battery_monitor.py","line":24,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:app/services/battery_monitor.py:24"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"app/services/battery_monitor.py","line":30,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:app/services/battery_monitor.py:30"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"app/services/ingestion.py","line":91,"fingerprint":"python.lang.best-practice.logging-error-without-handling:app/services/ingestion.py:91"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/js/app.js","line":6138,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/js/app.js:6138"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/js/app.js","line":6183,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/js/app.js:6183"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/nokia_battery_agent.sh","line":49,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/nokia_battery_agent.sh:49"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/js/app.js","line":2566,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/js/app.js:2566"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/js/app.js","line":2566,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/js/app.js:2566"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/js/app.js","line":2579,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/js/app.js:2579"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/js/app.js","line":2579,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/js/app.js:2579"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/js/app.js","line":2592,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/js/app.js:2592"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/js/app.js","line":2592,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/js/app.js:2592"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0526,"test_lines":0.0,"source_lines":16420.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0132,"cochange_commits":152.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":272.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":68.0,"escapes_per_kloc":7.252},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}