{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:14:07.208995Z","repo":{"ref":{"host":"github.com","owner":"QoderAI","name":"better-harness"},"default_branch":"main","clone_url":"https://github.com/QoderAI/better-harness.git","html_url":"https://github.com/QoderAI/better-harness","description":"An open-source Harness Engineering platform for coding agents—define harnesses as code, run controlled experiments, inspect evidence, and compare outcomes. Turn task evidence into actionable team and organization insights.","stars":2459,"forks":205,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":11429,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-07-21T12:30:35Z","pushed_at":"2026-11-11T15:06:54Z","security_policy_url":null,"distribution":{"owner_created_at":"2025-07-04T10:48:46Z","owner_type":"Organization","release_assets":[{"name":"builder-debug.yml","size":869,"download_count":5,"release_tag":"v0.7.0-alpha2","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/builder-debug.yml"},{"name":"Harness.Studio-0.1.0-arm64-mac.zip","size":174657360,"download_count":12,"release_tag":"v0.7.0-alpha2","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio-0.1.0-arm64-mac.zip"},{"name":"Harness.Studio-0.1.0-arm64-mac.zip.blockmap","size":181491,"download_count":5,"release_tag":"v0.7.0-alpha2","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio-0.1.0-arm64-mac.zip.blockmap"},{"name":"Harness.Studio-0.1.0.AppImage","size":167652747,"download_count":7,"release_tag":"v0.7.0-alpha2","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio-0.1.0.AppImage"},{"name":"Harness.Studio.Setup.0.1.0.exe","size":140094847,"download_count":15,"release_tag":"v0.7.0-alpha2","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio.Setup.0.1.0.exe"},{"name":"Harness.Studio.Setup.0.1.0.exe.blockmap","size":144495,"download_count":11,"release_tag":"v0.7.0-alpha2","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio.Setup.0.1.0.exe.blockmap"}]}},"commit_sha":"c6240a808923630db9d6397ced789eab509f0f66","profile":{"lines_by_language":{"JavaScript":189150,"TypeScript":99464,"Rust":43143,"Go":433,"Objective-C":231,"C":114},"files_by_category":{"source":943,"docs":516,"test":328,"config":95,"other":46,"generated":15,"binary":9,"vendored":7},"source_lines":226503,"test_lines":106032},"pillars":{"ai_provenance":{"score":42.2,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.422,"suspected_share":0.1213,"estimated_share":0.422,"ai_artifacts":4.0,"flagged_work_units":47.0,"flagged_releases":4.0},"summary":"Explicit AI attribution on 42% of first-party code added; an estimated 42% including velocity signals."},"quality":{"score":75.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":42.5,"duplication":71.7,"lint":74.9,"testing":88.4,"docs":100.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.47, CI runs tests; 28% of function code in complex or long functions; 6% duplicated lines. Weakest area: complexity."},"security":{"score":38.7,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":71.7,"sast":83.9,"dependencies":0.2,"ci_actions":0.3,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 199 known vulnerabilities in 64 dependencies; 32 high-severity SAST findings; 31 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":154.0,"checked":154.0,"missing":1.0,"recent":0.0,"lookup_errors":0.0},"findings":[{"rule_id":"registry.missing-package","severity":"high","message":"npm package '@homology/integration-harness-notebook-provider' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register","path":"packages/harness-studio/package.json","line":null,"fingerprint":"registry.missing-package:npm:@homology/integration-harness-notebook-provider"}],"evidence":[{"kind":"missing-package","description":"npm: @homology/integration-harness-notebook-provider (declared in packages/harness-studio/package.json)","ref":"packages/harness-studio/package.json","url":null,"weight":0.0}],"data":{"phantom":true},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":555.0,"attributed_commits":241.0,"attributed_commit_share":0.43423423423423424,"effective_loc":374715.0,"attributed_loc":158132.0,"attributed_loc_share":0.42200605793736573,"tools_detected":3.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"OpenAI Codex: 202 attributed commits, 135,506 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 38 attributed commits, 22,358 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 1 attributed commits, 268 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"a7d77fb59e04191589f826be4f3b7a6b9ab6326d","url":"https://github.com/QoderAI/better-harness/commit/a7d77fb59e04191589f826be4f3b7a6b9ab6326d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"0dd790b03aa0e40eb7b90fe304d9027476928c32","url":"https://github.com/QoderAI/better-harness/commit/0dd790b03aa0e40eb7b90fe304d9027476928c32","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6a711e0c35a9c3dac88e086cc6545e88763569e3","url":"https://github.com/QoderAI/better-harness/commit/6a711e0c35a9c3dac88e086cc6545e88763569e3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"eb7344b14dad99387c3b107b1d8e1b3821c4c622","url":"https://github.com/QoderAI/better-harness/commit/eb7344b14dad99387c3b107b1d8e1b3821c4c622","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c382a0f5af7269448ff232a3102078e8b4cf8658","url":"https://github.com/QoderAI/better-harness/commit/c382a0f5af7269448ff232a3102078e8b4cf8658","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"63e663a231bca595e9750742ba158d86c5a459b0","url":"https://github.com/QoderAI/better-harness/commit/63e663a231bca595e9750742ba158d86c5a459b0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ddd9672852e85bf54dd62f12ed48b5d1119676dd","url":"https://github.com/QoderAI/better-harness/commit/ddd9672852e85bf54dd62f12ed48b5d1119676dd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"10c0b989b7d2076e0f6a9acc8e3167ce86111547","url":"https://github.com/QoderAI/better-harness/commit/10c0b989b7d2076e0f6a9acc8e3167ce86111547","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"88a370307a10fe31ea978823ce6c0e4d0e818b5e","url":"https://github.com/QoderAI/better-harness/commit/88a370307a10fe31ea978823ce6c0e4d0e818b5e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"daddbadff45285e7704b3052cae276a1901ef11d","url":"https://github.com/QoderAI/better-harness/commit/daddbadff45285e7704b3052cae276a1901ef11d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f361661c6a9e3bbab49a750babaa7544e390fab3","url":"https://github.com/QoderAI/better-harness/commit/f361661c6a9e3bbab49a750babaa7544e390fab3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d02f44c5397ea8256d63d70a526e1fb3c4c0f621","url":"https://github.com/QoderAI/better-harness/commit/d02f44c5397ea8256d63d70a526e1fb3c4c0f621","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a85b6bd095dbaf6948a533a1fb081b545a8e135e","url":"https://github.com/QoderAI/better-harness/commit/a85b6bd095dbaf6948a533a1fb081b545a8e135e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e8e8d1be3cf7c988ea88cd25b07666525d1579ee","url":"https://github.com/QoderAI/better-harness/commit/e8e8d1be3cf7c988ea88cd25b07666525d1579ee","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2d787f577cf330e090e5d8f0559c1015317aad16","url":"https://github.com/QoderAI/better-harness/commit/2d787f577cf330e090e5d8f0559c1015317aad16","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ce4348c2edf5d7c6fc0eb36a6c8c037c74413a6d","url":"https://github.com/QoderAI/better-harness/commit/ce4348c2edf5d7c6fc0eb36a6c8c037c74413a6d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"901d44b4e608229cff8d97dd025a95008a6ccac7","url":"https://github.com/QoderAI/better-harness/commit/901d44b4e608229cff8d97dd025a95008a6ccac7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4b5de00845995e2b7dc7b7e72e276bf0f361fb78","url":"https://github.com/QoderAI/better-harness/commit/4b5de00845995e2b7dc7b7e72e276bf0f361fb78","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7853d5eb788e373ebd9196f26430d03c0c2c4b0b","url":"https://github.com/QoderAI/better-harness/commit/7853d5eb788e373ebd9196f26430d03c0c2c4b0b","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"c8f20fcf57befc4df9b60e47dd2374a5c289f2fa","url":"https://github.com/QoderAI/better-harness/commit/c8f20fcf57befc4df9b60e47dd2374a5c289f2fa","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"5fe7136a7046058f83a5edc1f2fdb762f98a4d1b","url":"https://github.com/QoderAI/better-harness/commit/5fe7136a7046058f83a5edc1f2fdb762f98a4d1b","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"011ce0fa7ac811b550b5a0cdde4d42645020ca2b","url":"https://github.com/QoderAI/better-harness/commit/011ce0fa7ac811b550b5a0cdde4d42645020ca2b","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"206f90495d732542c74ca8a8f1b63de2dc654b74","url":"https://github.com/QoderAI/better-harness/commit/206f90495d732542c74ca8a8f1b63de2dc654b74","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"9491e8b7e08d37cf571717db7c42dd2565f4fc78","url":"https://github.com/QoderAI/better-harness/commit/9491e8b7e08d37cf571717db7c42dd2565f4fc78","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"b235af5a090dd0985186311be9727f719d6a1831","url":"https://github.com/QoderAI/better-harness/commit/b235af5a090dd0985186311be9727f719d6a1831","weight":0.9}],"data":{"attributed_loc_by_commit":{"52e699670a351e75c7b63384c77aefc298071b39":55,"cb957fb4360e7c437fe9252ceb384825b50b81dc":129,"4b6f7227cf37aaed9420555c932af4d708919f72":4,"97748e1e64e02d9e8e802ca03d189cb98623d130":1616,"ed4219fb1bd9339bd8891c89ba42d9472986e365":341,"2d5a966a9a60718ae4dd5c3843cf4435d54a6f45":68,"ba9b2fa55115f9096dcdfef87dcd173e120c3d63":543,"ebdcfa6b19bbba669becc9831b0266c4f144c834":2,"24ce7914c809956054edeb735e6c159164570140":118,"4b871d9b402bcccc3a31e1b18247c088de854b0f":1241,"973751e3857c953a1b13a7575581332268d18648":0,"754a7d8cfd9e3c044807c446002438be9a7e2377":289,"46c71b6cf57dfb716e5006078e52e5966204e7e4":185,"25888eac1b5fa5fde17dece96f687ca6b0783de5":27,"44606af9781e2f265c8bd13febc5e380fe7a26e8":0,"446bb27c7708baa3d1ec1dde0af297cdda73db7e":1293,"755a61f7852f0d936dbf1cae69ce017506490c3f":230,"e7b326e7b694295ce2a2bac4874a71fd85e0ac49":355,"a7fb8e4cac9b3f1e93b00649fe4b8c91680917bf":127,"b46cfa06b05170663803a0324b98ce25cfcc9391":0,"0526d23157c11c1ccf343315c477cce4bb05ba64":96,"9421df18ca21bf5c99eb57e8fb6cdc48ba99a800":6907,"940f732686f4a1da6faf00258f774d3e43918c83":112,"305d63eb513d0a2a698c575bd2707190ad0a9a68":493,"443ec467d51eaa0377e78cd48676171ccb36941e":389,"b88a04ca810f9c7add43d9a5bc2aced72a51dfe1":1313,"47d1964897835dd299e78d52c21eaf4abd507c0f":248,"d0532752acc09c67de6a5c1c4c370ea12f3753a9":1825,"bbed86e16e55b0ed5d71df19d1f955daef3da89c":313,"2b17a66ffc37289d3ca5cbcb8c9b0ccc53a5b178":154,"98560a53a110e90622e47ff09475d6e89ecf922e":44,"25f49b1fd188df30f293fd1e583583afd82cf88e":609,"2ada64ebd3d5635410be64dd0cd2d713d8699baa":9,"ccbf03986861388480e97f2502194130ea13851f":1374,"555ce85e43214e7d69b9169614e44c166588d5b4":0,"ea259dc0b625b35fa5053c083bc69790aa5c3053":996,"81440ba31c40668287eab6c4b7259f12a218d621":353,"948291b563d9efc4cd357854b9ee8f69c659cae3":371,"b4f3ce16f66f0d9ac9b54dc1f9f0f70fd7a9ade7":2437,"16629cd1b8a7321abefb8efdbbb3a7624741fc05":4,"f27fd721ab4ef1c0ef96033a05692eecd793b057":4,"d4a9fa1caf196e74221d11d570fc73282a70d858":337,"d9a38fde02ae9ba78abbf4a0b98d07b83f78be10":283,"d5a72efb736a3edba3563117136c358ed8f8234d":291,"fe53efe815c6c3f581b5995a5bf18fb5149d7240":80,"9decd4b8b25d76e7fed64f23b8343f64d9aa4d83":26,"4f9538f87078142faa0fc25ea16efa89b9ce9cb5":0,"cf4915e60425d5dbbdb7780fee3cbf84a93ecff5":226,"e27772a8423a84f6a67f1eb08c643f0ce6486ca3":0,"4c839890ed175d6ccff8617d22556052a17056b5":69,"463645c990b2fbcf517cafd95706282833e4d88e":49,"6d68cb508e10d2c7fcf6be994cc35992ab695a27":855,"2f17b7dc2f23da8d69fcf47753a2aef7620f8350":0,"ee064432b9584e25ed14fb1a5484d78277ca2f98":273,"f26379dd6dea9c19237237456ddbd83b31195dfb":16,"0a595949639dc4f1ee3ce544e129809bb73b793a":0,"e0f07717f5deeb998bf8be0bbbedee3c8e5eaca4":8,"2c79b55da7ce443287e0f02a347935229cdbfca7":0,"6bc7536e275b695ba13583861ba30e400e859e0f":210,"6796ce96fc6cd909e1773b14ba71b51e3132cda9":0,"706570b823acd093f1176c423a4910e16cc719a0":4520,"e2262411fb995c70ac66261f442213f7e3cc6601":197,"e519865fb9bcc1682ae863a885bf0b526f7d8fc6":1923,"e5b118a4a62f946ecdc3d7c37d398b81451dd22e":364,"b8b80b5d83e23017463c562d82926fbe3c6671d4":967,"75fd392f1ce2c3edcdf1411ca83252c15d41afad":27,"7324ded4586c2bc884e523d80c1702f56d1be7b5":3662,"f41594fbd4c077bbb6fc7b0c122d229b1db0da7b":4160,"1166fd0bdd3b33e1314265d8efb7b5ed1f163eb1":861,"6c3f1a4aba9c926e96b74a9ab58cc7459192d21b":3456,"a35cbe6c9af12f6b396342fcfa51fb05bb59f933":891,"7ed73840b00cf52f66292c8166fe88d0c9a6460c":1030,"fdfd26ea1de4bf88fd8f93989be326f13fa24de2":1925,"bdc75735cc720b4ba5355fb4bd2fdd93f0b0aaae":10,"2c2d1df22a82d896e43ca64a7c34f289da1cf18f":2,"5ce05139afe72ca45c053c76a7681a74a14782cc":2,"a21223f402129f59a39b2383a9c98903695d653a":361,"39bb2e0db3a84a00db7538dce286261b6ff740dc":27,"1a6b0a134f229a786e0338d86de440fc50dc05a0":4,"b80dccd3e3cc36f2da9fb16f57098cadd2289f83":3687,"ef669b254dc5a3c7ce9221ac2c7976dbdadb5937":1671,"74657d28ebb75054606742db61e359dfd390b914":2965,"81e331153e6ffc9db3a75bbd473acd1faf31627f":409,"34f5283d4db358faffae981004935f39efab4f8d":965,"87edfeb3585c28dd4cf6c7adfcb9ffcebd848c40":1460,"c9b59e55fbafe757ecb0ed78f498ce52a2c701e9":109,"3186b30f8e31a79c583eb0b37b3467e4e6d129eb":163,"3f869d17ec2371b6367a61a56273be8a8ac2dbd0":18,"cd9116b20336c6bd34e84a56b7b4772e044dd41b":86,"cbe3de18ba75f49af2b064fee4343d46956e236c":5674,"d72155f7e20849e6b55cb7c80c5c182c014f579d":0,"beaf639ef97ebfc51c0f8a7c9a8445792c8de549":775,"1ea8d17d4f8e687465cb4d26c7f3b8ade22a143a":27,"b2be0f636cbacc965fdc9c16daa3ecb88f5f86f7":401,"7b2b7d1dcb7282f139dadd4f1a8504c40c8abc20":13,"6280985dcf05450b44c5876521fb2f7b770ab7fa":25,"7a8cc315e41a21a1d38bd74a9c279b6add0a5c61":83,"a85cefc368f51f0403c0fe82d113f9b65d24ea51":54,"f7653ed221f37d5737eae3a093cf9bd394c2ff97":165,"09b7ad29ce23bb5db73deb21ed483e1389876399":88,"1b6f93898d1b33242589de7a6083ef52563c1d42":0,"74229c27bf3193c0c3223dd1597368d14aa77e5f":45,"103c21c894e05679ae17eda097f9ca3c4574f957":0,"f730a7d44c2e89b70274f1c7e1a1d9f71e056107":158,"53534b2fb38f9bfe15985cd020293286da079ba3":84,"919b0408f63e776ce1e104b62b7b853fff785380":0,"386fa122c72ccbdb3a6db12f34553db596fb0ef0":56,"32067bf895aea6f5cd20d2b8f181c8232159504f":3,"a739826e0bba1e5fdcce291d23e3eb0856c19098":0,"50b42e65b9b61c18db26c11c625fd3b606576d6b":746,"9f097577a641e9b7ddc53b0f997861a37a340a26":126,"71e771e6275dc6573ab576c8240fac8899254c22":324,"ec84b4969c40859d85d4082cab7f733b011a3755":18,"a6739f33e700c0fbb2f02db41cbe07de4578070c":1174,"a9052428063f3abc59babbe9af8e03fb19578f7b":3616,"36ea2795f4b9aaf05dcbf0b55111363e2dedf237":1277,"b737e868b5b1c9f686feb8a48a05e4fd287e40a5":948,"ea0da391e25bd72e190bfb5b92a10c5b1256768f":36,"1d7297d35976d882657693dc8b3aeffe2abe63ac":661,"fd2ed9bf94e86fd358c2f32da9bc80edf2c862ee":2015,"eb6d99c9dc5c57920d7dd8bde6814cd23ab1769a":286,"1e6ad4ac32c3a890817917557d0a7f51a235b060":1805,"00c498f6635c2e87e785fb48f9eebcae8402fb18":372,"341f43cc655dcdb48ae25dfb7f52b1d5f9178dfc":0,"4766d1d002e45dc52b9a16f874b2ca2f382b1c71":0,"23b69e725e3642821b3b4c0e9b8c7f0f0066c408":16,"d73a8c15ed92f46c745e8fbb05994b2b4a2721b6":0,"9b0b601793d02054ab64352edce7c87e4fb560f2":1970,"32e1852039617c9df36ea5818f4ae6b58655956f":1,"c6ae2b2358ff7e675c70f1a8adbc42e306e655c6":3991,"b97035ba606bf373d3581ea94b874e366251544f":529,"fabfc7ef366ed3e0abbe8a58918da64360826522":2218,"90252e1606e552752130468bfb7644461a1ca5e2":649,"1361efe337125a9700414ae81391c71bbe7f1c58":133,"aa20e56cd3b9dddf7122e07a64f7887eb5337fb7":103,"f96091027bcda2bb6e705e035c612deadb7860a8":44,"e61beac2c60505c3e11f15b6d40ea7460c3811f6":1348,"f599328c000b05da4bffeeaccde2241b6fdf7922":1815,"c22aa7ac526f0af9818130ba7a6191e6350607dd":13,"c687b54f45b7a61d7952ec9e5a0432d12ceac30c":24,"df4b5b025945431e9bdccb6f9488ee65ebe44d8a":615,"84e32b77fcabb0fd294bbc5ee38f62fe77f2349f":3218,"8292495b1951e90a88bd18aa88db7702e71dbcab":0,"6e0d68bf4047a17c27400bfd5ef4e5ce53e7ec4a":150,"a415fa64b26bfdb9744d5368cdd21ffa21600e25":62,"3d6f3d7fdc033170f38e52e609b7ea7244b35491":1320,"684e7271babe291514593ff3ab87ef9766a351c3":1217,"1b01854990a5d05f9d3de7a6ed871bfe1a66d386":102,"c16dd29d29f7b39f047a8894d646dc6add4cf18e":7626,"b026a698c4108fc5a0bc8d3938c27f8caf819f92":336,"6f3194d942719c2aa27ae3feb2984cc0e30d63dc":2,"333140b9abbec1a8c9c1d252a8ffeb8b2162ceae":1399,"155fbbf025f17daafef9523055a944c6b21c549c":806,"390c9aa183ea9cf4fc38b424adde173a9c91e524":438,"c84e6204436469ebbf089641818d09746aab0043":1131,"5a706ea942f628d60741e6583814af0a0d3a0a39":1455,"bfb939d12ed57aa6bbea5a5a1a279db27d1379c7":253,"8460c23c81ea0c9739ca6a6c7cf555c20f402af2":537,"7351c0f22895d203a0b4933b3d594c8805295b0d":0,"97acb42f6d862c0895532ad93a14f0a6bef36bbc":283,"ef6b9f0fafeb010cd9587c0e8b156ac5ad4dff0d":1009,"963f376f70ec97b3933a5e811d6cc40cf84b632e":451,"4a2edcbfb13251a4cd37eeb540e0433ab6269e32":65,"8ab98bb2e10c10a737e93d39fc23d28739e45083":77,"1089be2006be3650c671a3a4b517072afd748693":151,"ff375d3a1fb02dcb33ef0ff6f4d6f7c6607690d0":984,"ca077eee4b2407cc9f29102339b695f6eba86e5f":1729,"057ce8689a9f4f38399f2f0ff72049c37c380446":1139,"19c9716950f45925fa604d4a9f189ba53b9e146f":374,"177714970ca204ec98defcead9d1510b259202e1":135,"0427b755a9023b55cb3758e3ef85943df388dcc7":179,"a806066aae00a88ba92a295e362e356eb04c0c53":0,"f972936b1f394273e498febfea7937b5dd5d2ec3":60,"99c3c183d3b1347053951c8c7068bc56967f28e2":0,"df0594d37ec97d1eb27245bdc5a1e538725fba9a":1359,"a79b45976df9c1970242b9badf38ee9ed28e8720":1196,"bd14fdd6c5893e675343830f3f8b617b4b00b9a4":1703,"33589061417584270d8d96432b06b73e95a11941":1503,"74ffcc44ed587cf6f52d6206d8296613612b6aef":230,"276cf3bdcb853da658449f2c1cf21ea914a2f1fc":1408,"7ffb79b7b66824932ffd15de178c4b1c439401ed":436,"4ec7e2cc85b653a945b6abac8077a8bbcf1af74d":526,"496b171960a5810bb3b579c2dffd916d5ba46287":1,"f17b0af7e7f1f3f61f2b8179a2542eebd7b43825":10,"5e70a2e823bcb53747c2aad0af6e536c71c3297e":0,"cfdf0d6d593b884db64bfc6562d58b1ca8bf5130":15,"26ef75087a6e84b07d3f42b2965ca15cbf999801":0,"45dbf13d452f621bd4ae3159a862cec96950d28b":360,"9f43b05632b76cf71ec23353f3b55d68122a56c7":120,"f25cb466c34e290edd0e7bb6b79536a0f09c6dcf":268,"3920fd13ef467b9b1b85d55760fea78f84823e06":517,"79f7ef23ad3af457ca21c7ed9fcbf82bb42bb2b1":710,"49faf7c90abe5cbc175cfccb470d9a417df68472":359,"e5f242a86291218aa4d175eb1e2a05febc309ff7":781,"944c6a9cb41c54804e6562dedb0d1067ef460d22":51,"adfd7cb2ef3b6996d50cf07c5b2976ccd1d7c5be":202,"2ca3bec8cbbacf687ba04ca6e1db2b2702ba03cb":815,"d760a4ac9e40906d13672c25e6f159976b5b8909":454,"447b581852f3390af6a1f7f6be53b365fbffa2f6":265,"114f091cda832bcbf6e6062e2e99233bc44e2911":434,"1eea73a981fe04dd563cbf96c9096aae8bd8e15c":933,"c03cc1394dd1c9a39fd3d271ef93fc1ade1b0d81":2062,"a61a89099ecd2f0f1d2460e88f69ea084391ce8b":605,"b11a001486b55333aaca4abb9f035d90a8cf928f":246,"db1e9ad2136c5fdbd4986c23d20edb5b6aaa749c":435,"904aeebe27788bd2ccb1ea46c724f097510a50c2":1537,"a71a8263dac7f2f5f8fe4f6a4a0c5e4bd95c9dd2":23,"de3d52a4936db9fff7189288c74a74990cb0b249":7,"31b637538f8937e5d65d6e2ec7b30ff49f2f11aa":91,"32099caced77fc7376b84d2f8ea6f621c2fe8da8":252,"cdc602f641e93029e69286ccd192f763dd09e490":1059,"f7fd1cc32a7abcc8ad5e8da93f796c36ad2c9845":1208,"ca0122858db32d27a5b3ed7ee051f7218d077f3d":6,"c933f9d385d31c7afb0ea2cdff502837fa560688":2,"53d409a5d1dfced6ad157d8332a82c44add22e61":33,"f1e0049ed1484a88234e5334beb187a72a5d6c6e":195,"b235af5a090dd0985186311be9727f719d6a1831":762,"9491e8b7e08d37cf571717db7c42dd2565f4fc78":662,"206f90495d732542c74ca8a8f1b63de2dc654b74":2708,"011ce0fa7ac811b550b5a0cdde4d42645020ca2b":2,"5fe7136a7046058f83a5edc1f2fdb762f98a4d1b":1265,"c8f20fcf57befc4df9b60e47dd2374a5c289f2fa":0,"7853d5eb788e373ebd9196f26430d03c0c2c4b0b":290,"4b5de00845995e2b7dc7b7e72e276bf0f361fb78":63,"901d44b4e608229cff8d97dd025a95008a6ccac7":137,"ce4348c2edf5d7c6fc0eb36a6c8c037c74413a6d":64,"2d787f577cf330e090e5d8f0559c1015317aad16":46,"e8e8d1be3cf7c988ea88cd25b07666525d1579ee":39,"a85b6bd095dbaf6948a533a1fb081b545a8e135e":503,"d02f44c5397ea8256d63d70a526e1fb3c4c0f621":1837,"f361661c6a9e3bbab49a750babaa7544e390fab3":470,"daddbadff45285e7704b3052cae276a1901ef11d":685,"88a370307a10fe31ea978823ce6c0e4d0e818b5e":9,"10c0b989b7d2076e0f6a9acc8e3167ce86111547":7,"ddd9672852e85bf54dd62f12ed48b5d1119676dd":356,"63e663a231bca595e9750742ba158d86c5a459b0":474,"c382a0f5af7269448ff232a3102078e8b4cf8658":0,"eb7344b14dad99387c3b107b1d8e1b3821c4c622":130,"6a711e0c35a9c3dac88e086cc6545e88763569e3":34,"0dd790b03aa0e40eb7b90fe304d9027476928c32":376,"a7d77fb59e04191589f826be4f3b7a6b9ab6326d":265},"tools":{"openai-codex":{"name":"OpenAI Codex","commits":202,"loc":135506,"first_seen":1785300708,"last_seen":1791778126},"claude-code":{"name":"Claude Code","commits":38,"loc":22358,"first_seen":1786605629,"last_seen":1789111032},"github-copilot":{"name":"GitHub Copilot coding agent","commits":1,"loc":268,"first_seen":1788490725,"last_seen":1788490725}},"monthly":{"2026-07":{"loc":114609,"attributed_loc":6719},"2026-08":{"loc":154288,"attributed_loc":117812},"2026-09":{"loc":104632,"attributed_loc":33336},"2026-10":{"loc":1102,"attributed_loc":265},"2026-11":{"loc":84,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":4.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1785140315.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"packages/harness-ui/CLAUDE.md (claude-code configuration)","ref":"packages/harness-ui/CLAUDE.md","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/harness-ui/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":"packages/harness-ui/AGENTS.md (generic-agent configuration)","ref":"packages/harness-ui/AGENTS.md","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/harness-ui/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":"test/fixtures/harness-component-snapshot/project/AGENTS.md (generic-agent configuration)","ref":"test/fixtures/harness-component-snapshot/project/AGENTS.md","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/test/fixtures/harness-component-snapshot/project/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"packages/harness-ui/CLAUDE.md","added_at":1788351695},{"tool":"generic-agent","path":"AGENTS.md","added_at":1785140315},{"tool":"generic-agent","path":"packages/harness-ui/AGENTS.md","added_at":1788351695},{"tool":"generic-agent","path":"test/fixtures/harness-component-snapshot/project/AGENTS.md","added_at":1785605887}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":260.0,"flagged_units":47.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":227123.0,"flagged_loc":128227.0,"flagged_loc_share":0.564570739202987,"max_loc_per_hour":12838.0,"median_loc_per_hour":280.0,"pr_timed_units":30.0,"excluded_import_loc":147592.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"6,419 lines of first-party code in ~0.5h (12,838 lines/hour, 2 commit session)","ref":"6ba02e0a6c61f773497ac4cd3cca79292aee2166","url":"https://github.com/QoderAI/better-harness/commit/6ba02e0a6c61f773497ac4cd3cca79292aee2166","weight":0.6},{"kind":"velocity-burst","description":"1,729 lines of first-party code in ~0.5h (3,458 lines/hour, 1 commit session)","ref":"ca077eee4b2407cc9f29102339b695f6eba86e5f","url":"https://github.com/QoderAI/better-harness/commit/ca077eee4b2407cc9f29102339b695f6eba86e5f","weight":0.6},{"kind":"velocity-burst","description":"3,945 lines of first-party code in ~1.3h (2,942 lines/hour, 5 commit session)","ref":"b11a001486b55333aaca4abb9f035d90a8cf928f","url":"https://github.com/QoderAI/better-harness/commit/b11a001486b55333aaca4abb9f035d90a8cf928f","weight":0.6},{"kind":"velocity-burst","description":"1,668 lines of first-party code in ~0.6h (2,839 lines/hour, 2 commit session)","ref":"057ce8689a9f4f38399f2f0ff72049c37c380446","url":"https://github.com/QoderAI/better-harness/commit/057ce8689a9f4f38399f2f0ff72049c37c380446","weight":0.6},{"kind":"velocity-burst","description":"3,662 lines of first-party code in ~1.3h (2,726 lines/hour, 1 commit session)","ref":"7324ded4586c2bc884e523d80c1702f56d1be7b5","url":"https://github.com/QoderAI/better-harness/commit/7324ded4586c2bc884e523d80c1702f56d1be7b5","weight":0.6},{"kind":"velocity-burst","description":"4,983 lines of first-party code in ~1.8h (2,725 lines/hour, 7 commit session)","ref":"17c4c01cc82ca8f69ac631a8cf35acd1e8c66383","url":"https://github.com/QoderAI/better-harness/commit/17c4c01cc82ca8f69ac631a8cf35acd1e8c66383","weight":0.6},{"kind":"velocity-burst","description":"4,214 lines of first-party code in ~1.8h (2,407 lines/hour, 4 commit session)","ref":"eb6d99c9dc5c57920d7dd8bde6814cd23ab1769a","url":"https://github.com/QoderAI/better-harness/commit/eb6d99c9dc5c57920d7dd8bde6814cd23ab1769a","weight":0.6},{"kind":"velocity-burst","description":"2,537 lines of first-party code in ~1.1h (2,310 lines/hour, 2 commit session)","ref":"684e7271babe291514593ff3ab87ef9766a351c3","url":"https://github.com/QoderAI/better-harness/commit/684e7271babe291514593ff3ab87ef9766a351c3","weight":0.6},{"kind":"velocity-burst","description":"3,016 lines of first-party code in ~1.3h (2,303 lines/hour, 1 commit session)","ref":"0e2fcd84685996b9eca44280e2ea6137ed9aaf29","url":"https://github.com/QoderAI/better-harness/commit/0e2fcd84685996b9eca44280e2ea6137ed9aaf29","weight":0.6},{"kind":"velocity-burst","description":"1,837 lines of first-party code in ~0.8h (2,274 lines/hour, 1 commit session)","ref":"d02f44c5397ea8256d63d70a526e1fb3c4c0f621","url":"https://github.com/QoderAI/better-harness/commit/d02f44c5397ea8256d63d70a526e1fb3c4c0f621","weight":0.6},{"kind":"velocity-burst","description":"4,556 lines of first-party code in ~2.5h (1,840 lines/hour, 5 commit session)","ref":"206f90495d732542c74ca8a8f1b63de2dc654b74","url":"https://github.com/QoderAI/better-harness/commit/206f90495d732542c74ca8a8f1b63de2dc654b74","weight":0.5520565466173006},{"kind":"velocity-burst","description":"2,445 lines of first-party code in ~1.4h (1,791 lines/hour, 3 commit session)","ref":"f27fd721ab4ef1c0ef96033a05692eecd793b057","url":"https://github.com/QoderAI/better-harness/commit/f27fd721ab4ef1c0ef96033a05692eecd793b057","weight":0.5373626373626373},{"kind":"velocity-burst","description":"2,320 lines of first-party code in ~1.3h (1,769 lines/hour, 2 commit session)","ref":"c03cc1394dd1c9a39fd3d271ef93fc1ade1b0d81","url":"https://github.com/QoderAI/better-harness/commit/c03cc1394dd1c9a39fd3d271ef93fc1ade1b0d81","weight":0.5308474576271186},{"kind":"velocity-burst","description":"4,118 lines of first-party code in ~2.5h (1,633 lines/hour, 4 commit session)","ref":"9f099588c1e553b326a876a3b65ef81bb9d21971","url":"https://github.com/QoderAI/better-harness/commit/9f099588c1e553b326a876a3b65ef81bb9d21971","weight":0.4899140779907469},{"kind":"velocity-burst","description":"3,957 lines of first-party code in ~2.5h (1,613 lines/hour, 7 commit session)","ref":"86b3ac02fcee0ee64bfdeff49bcb60d5db4d607a","url":"https://github.com/QoderAI/better-harness/commit/86b3ac02fcee0ee64bfdeff49bcb60d5db4d607a","weight":0.4838175025472659}],"data":{"flagged_loc_by_commit":{"03267cb9e71a6dcb255dc72c51a93a95685b06d1":2975,"67d6d1e1ee7b56eb64554b203ea9ee14383b0c53":56,"b4f3ce16f66f0d9ac9b54dc1f9f0f70fd7a9ade7":2437,"16629cd1b8a7321abefb8efdbbb3a7624741fc05":4,"f27fd721ab4ef1c0ef96033a05692eecd793b057":4,"afed21df11a0e4c2035cbe82803cf95705d18e23":589,"6d68cb508e10d2c7fcf6be994cc35992ab695a27":855,"706570b823acd093f1176c423a4910e16cc719a0":4520,"e519865fb9bcc1682ae863a885bf0b526f7d8fc6":1923,"e5b118a4a62f946ecdc3d7c37d398b81451dd22e":364,"b8b80b5d83e23017463c562d82926fbe3c6671d4":967,"75fd392f1ce2c3edcdf1411ca83252c15d41afad":27,"7324ded4586c2bc884e523d80c1702f56d1be7b5":3662,"6c3f1a4aba9c926e96b74a9ab58cc7459192d21b":3456,"b80dccd3e3cc36f2da9fb16f57098cadd2289f83":3687,"ef669b254dc5a3c7ce9221ac2c7976dbdadb5937":1671,"74657d28ebb75054606742db61e359dfd390b914":2965,"87edfeb3585c28dd4cf6c7adfcb9ffcebd848c40":1460,"4e16ff4677acaef559a62dba341f1eed21af15d3":1351,"6f14284c430abf4b4b3cacdafaa356d582ed6067":907,"8a35fc591ecec76592e907a4fdb8f208fc720837":5,"beaf639ef97ebfc51c0f8a7c9a8445792c8de549":775,"2c6d63c6629a0e2114e4a0df098274bee2430b06":1361,"aa20e56cd3b9dddf7122e07a64f7887eb5337fb7":103,"f96091027bcda2bb6e705e035c612deadb7860a8":44,"e61beac2c60505c3e11f15b6d40ea7460c3811f6":1348,"5a706ea942f628d60741e6583814af0a0d3a0a39":1455,"a79b45976df9c1970242b9badf38ee9ed28e8720":1196,"bd14fdd6c5893e675343830f3f8b617b4b00b9a4":1703,"50159b356a6d59cc99736312578e4d2cd4fda2ff":1084,"c880f5224d22d03ea0dfeafe727d33f286bd4d6e":1453,"2cfb79e170da8806758bfd807d9821d674c27e82":614,"6883b039a008f8c9d84d57b147426dde0472d89c":57,"f1610fd59a177fc1db73721dfd10709ef7a076e6":743,"f5074d2129400971ff402cf6a0f6def21c2001db":228,"17c4c01cc82ca8f69ac631a8cf35acd1e8c66383":804,"384c8c911aa8666df42e54ee59cca35a974e2849":280,"56a5dd1f6d437fdc2edbb1f90553823b11876cab":148,"4d2f2c534a93650933c70987f8ca5ac1969f7ce8":2894,"9f099588c1e553b326a876a3b65ef81bb9d21971":796,"d760a4ac9e40906d13672c25e6f159976b5b8909":454,"447b581852f3390af6a1f7f6be53b365fbffa2f6":265,"9cb0fdadfc49bd0516eac997ca58cf0422b7613a":348,"114f091cda832bcbf6e6062e2e99233bc44e2911":434,"1eea73a981fe04dd563cbf96c9096aae8bd8e15c":933,"c387f7811577fb13f3eee8829f77fa4a45d0b7b3":258,"c03cc1394dd1c9a39fd3d271ef93fc1ade1b0d81":2062,"a61a89099ecd2f0f1d2460e88f69ea084391ce8b":605,"ccd8b106e0f0dff471b8de0e7ab66b3a9eed3ccd":2677,"4eac161aa5192122a8d0b74656f6f41e6863fad2":6,"0a6ba40c8b23f6beafda782654d021d86f562aa3":411,"b11a001486b55333aaca4abb9f035d90a8cf928f":246,"37d707f1a9c0353fd73e29cd08d9bc0dc6fab7c9":77,"088f8a1ce57569f402e98c16467adbee62bb5876":851,"2d8f289b174ddfcc0bf565890f155058bd2d90d8":427,"2985f82bf3a92a34b6dca6fa6a51816c78fa2c72":9,"7f169f2b2e2d13d8772443970e0894e9f027ff18":34,"60c32d34b52ea5d52e0b030fe43cfd929ee86066":1736,"86b3ac02fcee0ee64bfdeff49bcb60d5db4d607a":823,"cdc602f641e93029e69286ccd192f763dd09e490":1059,"f7fd1cc32a7abcc8ad5e8da93f796c36ad2c9845":1208,"ca0122858db32d27a5b3ed7ee051f7218d077f3d":6,"c933f9d385d31c7afb0ea2cdff502837fa560688":2,"53d409a5d1dfced6ad157d8332a82c44add22e61":33,"f1e0049ed1484a88234e5334beb187a72a5d6c6e":195,"b792467c408fe51723d97a2d9339bafe3eb81593":4,"64932d8ce0f158ef27ecc07cd6e3859f5dca8752":562,"9491e8b7e08d37cf571717db7c42dd2565f4fc78":662,"8ba858cc0324c5948d1b53bcca7e6f59bb880998":623,"c4ef53babff5e0d9cc3009520a20fa578ef9737b":1,"206f90495d732542c74ca8a8f1b63de2dc654b74":2708,"5fe7136a7046058f83a5edc1f2fdb762f98a4d1b":1265,"bf0e67d7c08ba27ba76d4a94e4797688a70a580f":255,"ef127b4b46d43eca11ec43aec811473208e7d4a7":2,"139d30e4fc3f93a9f1323a8b981dc6dd1ac951f4":48,"e23ea7134b631ca5c2f191a9daca346c3f16b161":448,"4ad295b9fd1c9d427bdd9e21c8b3d9966fbd3be2":309,"dd71048b2f4a31473baf337154946883711e9f64":2128,"c78dd1c21885c46fab6fb65bf779ec27d996b11c":4,"d02f44c5397ea8256d63d70a526e1fb3c4c0f621":1837,"0e2fcd84685996b9eca44280e2ea6137ed9aaf29":3016,"d07cadf007d3bd3edab8a50b99fa56ea329190c2":5474,"6ba02e0a6c61f773497ac4cd3cca79292aee2166":945,"a2576e661ec8c8045d3522ff20d048d55c466ca0":1330,"fdfd26ea1de4bf88fd8f93989be326f13fa24de2":1925,"bdc75735cc720b4ba5355fb4bd2fdd93f0b0aaae":10,"2c2d1df22a82d896e43ca64a7c34f289da1cf18f":2,"5ce05139afe72ca45c053c76a7681a74a14782cc":2,"5d136f6bc0414f22855dc3d47a5d1d0707c15617":2433,"ec84b4969c40859d85d4082cab7f733b011a3755":18,"a6739f33e700c0fbb2f02db41cbe07de4578070c":1174,"36ea2795f4b9aaf05dcbf0b55111363e2dedf237":1277,"b737e868b5b1c9f686feb8a48a05e4fd287e40a5":948,"1778395137daf21bef3f4b3ca7caf87ac932fed6":468,"fd2ed9bf94e86fd358c2f32da9bc80edf2c862ee":2015,"08259cf229ff1b5c7b08def65ceaf5019c1dd4a6":1912,"8ce9571106e269591c370365499ad67a5d7ede5a":1,"eb6d99c9dc5c57920d7dd8bde6814cd23ab1769a":286,"1e6ad4ac32c3a890817917557d0a7f51a235b060":1805,"9b0b601793d02054ab64352edce7c87e4fb560f2":1970,"c6ae2b2358ff7e675c70f1a8adbc42e306e655c6":3991,"84e32b77fcabb0fd294bbc5ee38f62fe77f2349f":3218,"3d6f3d7fdc033170f38e52e609b7ea7244b35491":1320,"684e7271babe291514593ff3ab87ef9766a351c3":1217,"333140b9abbec1a8c9c1d252a8ffeb8b2162ceae":1399,"155fbbf025f17daafef9523055a944c6b21c549c":806,"390c9aa183ea9cf4fc38b424adde173a9c91e524":438,"7b4cd416a9bdedaa8ef25fcfd60d99ab8f656871":814,"60043cf22fd0c654cf70cbe99283b9f91db9c32c":86,"60b9b7a7e3d47fb42801de6ae03980c4bdb542b1":61,"97acb42f6d862c0895532ad93a14f0a6bef36bbc":283,"ef6b9f0fafeb010cd9587c0e8b156ac5ad4dff0d":1009,"963f376f70ec97b3933a5e811d6cc40cf84b632e":451,"c8b2aef8211b38b97e8b67a521e2ba30077760e0":1,"4a2edcbfb13251a4cd37eeb540e0433ab6269e32":65,"ca077eee4b2407cc9f29102339b695f6eba86e5f":1729,"94e0a5c36d4d8e21d1fec0c7145c29edc10106c3":529,"057ce8689a9f4f38399f2f0ff72049c37c380446":1139,"cbe3de18ba75f49af2b064fee4343d46956e236c":5674},"excluded_import_commits":["34899f36ef462c84025f256c32c1c957b6124089","5a8b66ccc6da808a47c9ef71e407612473468b49","6040d40105a18916fdc19a91fe162df39005bbd4","9421df18ca21bf5c99eb57e8fb6cdc48ba99a800","c16dd29d29f7b39f047a8894d646dc6add4cf18e","d13cba88924779e4e006384c1a558052dff81665","d66be37d10fd5b8d0322aca1d82aed71987e0331","f41594fbd4c077bbb6fc7b0c122d229b1db0da7b"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":10.0,"flagged_releases":4.0,"max_loc_per_day":7245.9},"findings":[],"evidence":[{"kind":"release-burst","description":"v0.6.3 → v0.6.4: 38,831 lines in 5.36 days (7,245.9 lines/day)","ref":"v0.6.3...v0.6.4","url":"https://github.com/QoderAI/better-harness/compare/v0.6.3...v0.6.4","weight":0.4},{"kind":"release-burst","description":"v0.6.4 → v0.6.5: 61,439 lines in 9.84 days (6,244.0 lines/day)","ref":"v0.6.4...v0.6.5","url":"https://github.com/QoderAI/better-harness/compare/v0.6.4...v0.6.5","weight":0.4},{"kind":"release-burst","description":"v0.6.6 → v0.7.0-alpha1: 8,917 lines in 2.77 days (3,221.6 lines/day)","ref":"v0.6.6...v0.7.0-alpha1","url":"https://github.com/QoderAI/better-harness/compare/v0.6.6...v0.7.0-alpha1","weight":0.4},{"kind":"release-burst","description":"v0.7.0-alpha1 → v0.7.0-alpha2: 49,728 lines in 9.07 days (5,483.4 lines/day)","ref":"v0.7.0-alpha1...v0.7.0-alpha2","url":"https://github.com/QoderAI/better-harness/compare/v0.7.0-alpha1...v0.7.0-alpha2","weight":0.4}],"data":{"releases":[{"from":"v0.4.1","to":"v0.5.0","loc":26,"days":0.1,"loc_per_day":260.9,"flagged":false},{"from":"v0.5.0","to":"v0.6.0","loc":14075,"days":8.74,"loc_per_day":1610.7,"flagged":false},{"from":"v0.6.0","to":"v0.6.1","loc":1571,"days":0.23,"loc_per_day":6833.5,"flagged":false},{"from":"v0.6.1","to":"v0.6.2","loc":560,"days":0.64,"loc_per_day":878.7,"flagged":false},{"from":"v0.6.2","to":"v0.6.3","loc":210,"days":0.04,"loc_per_day":5040.0,"flagged":false},{"from":"v0.6.3","to":"v0.6.4","loc":38831,"days":5.36,"loc_per_day":7245.9,"flagged":true},{"from":"v0.6.4","to":"v0.6.5","loc":61439,"days":9.84,"loc_per_day":6244.0,"flagged":true},{"from":"v0.6.5","to":"v0.6.6","loc":5840,"days":2.19,"loc_per_day":2662.2,"flagged":false},{"from":"v0.6.6","to":"v0.7.0-alpha1","loc":8917,"days":2.77,"loc_per_day":3221.6,"flagged":true},{"from":"v0.7.0-alpha1","to":"v0.7.0-alpha2","loc":49728,"days":9.07,"loc_per_day":5483.4,"flagged":true}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":226503.0,"index":0.075,"count:narrated_steps":11.0,"per_kloc:narrated_steps":0.049,"files:narrated_steps":3.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":8.0,"per_kloc:emoji_in_code":0.035,"files:emoji_in_code":5.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.004,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Extract facts from each source file","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:128","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L128","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Build symbol graph from extracted facts","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:135","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L135","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Build model from DSL or JSON","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:147","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L147","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 4: Build bindings","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:150","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L150","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 5: Project onto model","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:156","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L156","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 6: Generate DSL","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:165","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L165","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 7: Compute change overlay","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:168","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L168","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 8: Which declared elements the change reached without landing in them:","ref":"packages/better-harness-desktop/rust/arch-service/src/lib.rs:174","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/arch-service/src/lib.rs#L174","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":9.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"packages/better-harness-desktop/rust/evidence-host/src/performance/tests.rs","line":265,"fingerprint":"packages/better-harness-desktop/rust/evidence-host/src/performance/tests.rs:generic-api-key:265"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"test/sessions/session-analysis-core-facts.test.mjs","line":164,"fingerprint":"test/sessions/session-analysis-core-facts.test.mjs:generic-api-key:164"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"test/reporting/harness-report-render-cli.test.mjs","line":134,"fingerprint":"test/reporting/harness-report-render-cli.test.mjs:generic-api-key:134"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"test/reporting/harness-inspector.test.mjs","line":596,"fingerprint":"test/reporting/harness-inspector.test.mjs:generic-api-key:596"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"test/sessions/commit-session-link.test.mjs","line":796,"fingerprint":"test/sessions/commit-session-link.test.mjs:generic-api-key:796"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"test/sessions/commit-session-link.test.mjs","line":1145,"fingerprint":"test/sessions/commit-session-link.test.mjs:curl-auth-header:1145"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit b4f3ce16f6); removed from the current tree but still retrievable","path":"test/commit-session-link.test.mjs","line":472,"fingerprint":"b4f3ce16f66f0d9ac9b54dc1f9f0f70fd7a9ade7:test/commit-session-link.test.mjs:generic-api-key:472"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in history (commit b4f3ce16f6); removed from the current tree but still retrievable","path":"test/commit-session-link.test.mjs","line":766,"fingerprint":"b4f3ce16f66f0d9ac9b54dc1f9f0f70fd7a9ade7:test/commit-session-link.test.mjs:curl-auth-header:766"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit b4f3ce16f6); removed from the current tree but still retrievable","path":"test/harness-inspector.test.mjs","line":389,"fingerprint":"b4f3ce16f66f0d9ac9b54dc1f9f0f70fd7a9ade7:test/harness-inspector.test.mjs:generic-api-key:389"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 5a8b66ccc6); removed from the current tree but still retrievable","path":"test/session-analysis-core-facts.test.mjs","line":164,"fingerprint":"5a8b66ccc6da808a47c9ef71e407612473468b49:test/session-analysis-core-facts.test.mjs:generic-api-key:164"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":405.0,"findings_high":32.0,"findings_medium":249.0,"findings_low":124.0,"weighted_findings":113.312,"scanned_lines":226272.0,"parse_errors":17.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/harness-studio-apps/apps/file-viewer/ui/entry.mjs","line":129,"fingerprint":"javascript.browser.security.insecure-document-method:packages/harness-studio-apps/apps/file-viewer/ui/entry.mjs:129"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `disclosure.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/harness-studio-apps/apps/file-viewer/ui/entry.mjs","line":129,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/harness-studio-apps/apps/file-viewer/ui/entry.mjs:129"},{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: !npmCli && process.platform === \"win32\"}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false [confidence low]","path":"scripts/dsh-configured-assets/native-smoke.mjs","line":74,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:scripts/dsh-configured-assets/native-smoke.mjs:74"},{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: !npmCli && process.platform === \"win32\"}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false [confidence low]","path":"scripts/dsh-skill-discovery/native-smoke.mjs","line":52,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:scripts/dsh-skill-discovery/native-smoke.mjs:52"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1269,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1269"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1269,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1269"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1282,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1282"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `inspector.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1282,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1282"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1295,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1295"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `inspector.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1295,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1295"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1312,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1312"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1324,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1324"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1737,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1737"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1737,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1737"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1742,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1742"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1742,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1742"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1756,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1756"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `rail.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1756,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1756"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1775,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1775"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `rail.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1775,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1775"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1797,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:1797"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `stage.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":1797,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:1797"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2015,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:2015"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById('session-view-body').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2015,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:2015"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2110,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:2110"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `select.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2110,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:2110"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2122,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:2122"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2122,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:2122"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2173,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:2173"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById('workbench-list').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2173,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:2173"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2428,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness-inspector/ui/workbench.js:2428"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `files.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":2428,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness-inspector/ui/workbench.js:2428"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"dev/html-preview.mjs","line":44,"fingerprint":"javascript.lang.security.html-in-template-string:dev/html-preview.mjs:44"},{"rule_id":"opengrep/javascript.lang.security.audit.incomplete-sanitization","severity":"medium","message":"`pattern.replace` method will only replace the first occurrence when used with a string argument (\"*\"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. [confidence low]","path":"hooks/git-scripts/blast-radius/graph.mjs","line":331,"fingerprint":"javascript.lang.security.audit.incomplete-sanitization:hooks/git-scripts/blast-radius/graph.mjs:331"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"hooks/git-scripts/blast-radius/utils.mjs","line":62,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:hooks/git-scripts/blast-radius/utils.mjs:62"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"packages/better-harness-desktop/rust/pty-service/src/pty-core.c","line":30,"fingerprint":"c.lang.security.insecure-use-memset:packages/better-harness-desktop/rust/pty-service/src/pty-core.c:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9_]+(?:-[a-z0-9_]+)+$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library [confidence low]","path":"packages/better-harness-desktop/scripts/chart-runtime.mjs","line":13,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/better-harness-desktop/scripts/chart-runtime.mjs:13"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":12,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:12"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":26,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:26"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":32,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:32"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":58,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:58"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":64,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:64"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":80,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:80"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":109,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:109"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":135,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:135"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":166,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:166"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":172,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:172"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":194,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:194"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":200,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:200"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":223,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:223"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/better-harness-desktop/scripts/nsxpc-bundle.mjs","line":229,"fingerprint":"javascript.lang.security.html-in-template-string:packages/better-harness-desktop/scripts/nsxpc-bundle.mjs:229"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `glob` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"packages/harness-studio-apps/apps/file-explorer/server.mjs","line":416,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/harness-studio-apps/apps/file-explorer/server.mjs:416"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"packages/harness-studio-apps/apps/file-explorer/server.mjs","line":496,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/harness-studio-apps/apps/file-explorer/server.mjs:496"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio-apps/lib/hostApi.mjs","line":318,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio-apps/lib/hostApi.mjs:318"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/harness-studio-apps/lib/hostApi.mjs","line":352,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/harness-studio-apps/lib/hostApi.mjs:352"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if [confidence low]","path":"packages/harness-studio-apps/lib/manifest.mjs","line":482,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio-apps/lib/manifest.mjs:482"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio-apps/lib/manifest.mjs","line":483,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio-apps/lib/manifest.mjs:483"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"packages/harness-studio-apps/lib/manifest.mjs","line":497,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio-apps/lib/manifest.mjs:497"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"packages/harness-studio-apps/lib/manifest.mjs","line":534,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio-apps/lib/manifest.mjs:534"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"packages/harness-studio-apps/lib/manifest.mjs","line":574,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio-apps/lib/manifest.mjs:574"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"packages/harness-studio-apps/lib/manifest.mjs","line":706,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio-apps/lib/manifest.mjs:706"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"packages/harness-studio-apps/lib/manifest.mjs","line":727,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio-apps/lib/manifest.mjs:727"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio-apps/lib/static.mjs","line":113,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio-apps/lib/static.mjs:113"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio-apps/lib/static.mjs","line":114,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio-apps/lib/static.mjs:114"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/scripts/app-build.mjs","line":23,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/scripts/app-build.mjs:23"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/scripts/app-build.mjs","line":47,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/scripts/app-build.mjs:47"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/harness-studio/src/app/code/code-highlight.ts","line":123,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/harness-studio/src/app/code/code-highlight.ts:123"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/src/contracts/intent-correlation.ts","line":202,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/src/contracts/intent-correlation.ts:202"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^ {0,3}([-*_])[ \\t]*(?:\\1[ \\t]*){2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use  [confidence low]","path":"packages/harness-studio/src/contracts/markdown-parser.ts","line":139,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio/src/contracts/markdown-parser.ts:139"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^ {0,3}([-*_])[ \\t]*(?:\\1[ \\t]*){2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use  [confidence low]","path":"packages/harness-studio/src/contracts/markdown-parser.ts","line":221,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio/src/contracts/markdown-parser.ts:221"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^ {0,3}([-*_])[ \\t]*(?:\\1[ \\t]*){2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use  [confidence low]","path":"packages/harness-studio/src/contracts/markdown-parser.ts","line":259,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio/src/contracts/markdown-parser.ts:259"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^ {0,3}([-*_])[ \\t]*(?:\\1[ \\t]*){2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use  [confidence low]","path":"packages/harness-studio/src/contracts/markdown-parser.ts","line":273,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio/src/contracts/markdown-parser.ts:273"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^ {0,3}\\|?(?:[ \\t]*:?-+:?[ \\t]*\\|)+[ \\t]*:?-*:?[ \\t]*\\|?[ \\t]*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtrac [confidence low]","path":"packages/harness-studio/src/contracts/markdown-parser.ts","line":327,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio/src/contracts/markdown-parser.ts:327"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/src/server/artifacts/adapters/pptx-artifact-adapter.ts","line":405,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/src/server/artifacts/adapters/pptx-artifact-adapter.ts:405"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts","line":282,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts:282"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts","line":585,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts:585"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/src/server/cli.ts","line":421,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/src/server/cli.ts:421"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness-studio/src/server/cli.ts","line":425,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness-studio/src/server/cli.ts:425"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `snapshot` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contro [confidence low]","path":"packages/harness-studio/src/server/memory-parser.ts","line":43,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/harness-studio/src/server/memory-parser.ts:43"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^System(?:\\.[A-Za-z0-9]+)*\\.[A-Za-z0-9_-]+\\.wasm$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if p [confidence low]","path":"packages/harness-studio/src/server/providers/walnut/bootstrap.ts","line":343,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/harness-studio/src/server/providers/walnut/bootstrap.ts:343"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/harness-studio/src/server/query/observed-call-index.ts","line":83,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/harness-studio/src/server/query/observed-call-index.ts:83"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness/src/compare/runner.ts","line":650,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness/src/compare/runner.ts:650"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness/src/compare/runner.ts","line":654,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness/src/compare/runner.ts:654"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness/src/compare/runner.ts","line":655,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness/src/compare/runner.ts:655"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness/src/compare/runner.ts","line":656,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness/src/compare/runner.ts:656"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness/src/compare/runner.ts","line":658,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness/src/compare/runner.ts:658"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/harness/src/compare/runner.ts","line":661,"fingerprint":"javascript.lang.security.html-in-template-string:packages/harness/src/compare/runner.ts:661"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/harness/src/exec/qoder-sdk.ts","line":578,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/harness/src/exec/qoder-sdk.ts:578"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/agent-customize/cli.mjs","line":22,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/agent-customize/cli.mjs:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"scripts/agent-customize/providers/dsh.mjs","line":326,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/agent-customize/providers/dsh.mjs:326"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/agent-customize/providers/pi.mjs","line":79,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/agent-customize/providers/pi.mjs:79"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `rule` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/agent-customize/providers/qwen.mjs","line":56,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/agent-customize/providers/qwen.mjs:56"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"scripts/agent-guardrails/install-secret-guard.mjs","line":150,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:scripts/agent-guardrails/install-secret-guard.mjs:150"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"scripts/agent-guardrails/install-secret-guard.mjs","line":153,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:scripts/agent-guardrails/install-secret-guard.mjs:153"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `regex` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/agent-guardrails/secret-scan.mjs","line":954,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/agent-guardrails/secret-scan.mjs:954"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/agent-lint/cli.mjs","line":160,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/agent-lint/cli.mjs:160"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `fence` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/agent-lint/index.mjs","line":226,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/agent-lint/index.mjs:226"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"scripts/agent-lint/index.mjs","line":1319,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/agent-lint/index.mjs:1319"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"scripts/agent-lint/index.mjs","line":1397,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/agent-lint/index.mjs:1397"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/better-harness-cli/cli.mjs","line":121,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/better-harness-cli/cli.mjs:121"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/better-harness-cli/cli.mjs","line":122,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/better-harness-cli/cli.mjs:122"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/better-harness-cli/cli.mjs","line":193,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/better-harness-cli/cli.mjs:193"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/coding-agent-practices/asset-baseline.mjs","line":184,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/coding-agent-practices/asset-baseline.mjs:184"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/coding-agent-practices/asset-baseline.mjs","line":189,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/coding-agent-practices/asset-baseline.mjs:189"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/coding-agent-practices/asset-baseline.mjs","line":198,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/coding-agent-practices/asset-baseline.mjs:198"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/coding-agent-practices/asset-baseline.mjs","line":202,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/coding-agent-practices/asset-baseline.mjs:202"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^mcp__([^_]+(?:_[^_]+)*)__.+$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a librar [confidence low]","path":"scripts/coding-agent-practices/checkup/scan.mjs","line":169,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/coding-agent-practices/checkup/scan.mjs:169"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":71,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:71"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":74,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:74"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":82,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:82"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":83,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:83"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":93,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:93"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":96,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:96"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":97,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:97"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":103,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:103"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":104,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:104"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":113,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:113"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":120,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:120"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":137,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:137"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":199,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:199"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-html.mjs","line":214,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-html.mjs:214"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":35,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:35"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\s*\\|?\\s*:?-{3,}:?\\s*(?:\\|\\s*:?-{3,}:?\\s*)+\\|?\\s*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":47,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/commit-session-link/render-session-html.mjs:47"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":57,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:57"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":57,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:57"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":57,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:57"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":57,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:57"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":64,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:64"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":74,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:74"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":84,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:84"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":92,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:92"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":94,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:94"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":125,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:125"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":127,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:127"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":128,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:128"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":134,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:134"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":136,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:136"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":140,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:140"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":143,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:143"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":146,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:146"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":148,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:148"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":161,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:161"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":169,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:169"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":175,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:175"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":332,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:332"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":332,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:332"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":338,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:338"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":345,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:345"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":347,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:347"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":349,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:349"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":358,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:358"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":360,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:360"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":364,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:364"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":364,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:364"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":391,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:391"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":397,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:397"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/commit-session-link/render-session-html.mjs","line":415,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/commit-session-link/render-session-html.mjs:415"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/core-change-watch/common.mjs","line":180,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/core-change-watch/common.mjs:180"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/core-change-watch/help.mjs","line":22,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/core-change-watch/help.mjs:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `regex` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/dependency-governance/cli.mjs","line":548,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/dependency-governance/cli.mjs:548"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `mod` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"scripts/harness-analysis/canvas-preview/transform.mjs","line":10,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/canvas-preview/transform.mjs:10"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/evidence-bundle/cli.mjs","line":17,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/evidence-bundle/cli.mjs:17"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `(?:^|[\\s\"'`([{:;,=])\\/(?!\\/)(?:[^/\\s\"'`(){}\\[\\],;:]+\\/)+[^/\\s\"'`(){}\\[\\],;:]+` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastr [confidence low]","path":"scripts/harness-analysis/intervention-ledger.mjs","line":79,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/harness-analysis/intervention-ledger.mjs:79"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `(?:^|[\\s\"'`([{:;,=])[A-Za-z]:[\\\\/](?:[^\\\\/\\s\"'`(){}\\[\\],;:]+[\\\\/])+[^\\\\/\\s\"'`(){}\\[\\],;:]+` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerab [confidence low]","path":"scripts/harness-analysis/intervention-ledger.mjs","line":80,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/harness-analysis/intervention-ledger.mjs:80"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"scripts/harness-analysis/learning-capture-evidence.mjs","line":122,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/learning-capture-evidence.mjs:122"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `skill` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/harness-analysis/learning-capture-evidence.mjs","line":199,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/learning-capture-evidence.mjs:199"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `status` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"scripts/harness-analysis/learning-capture-evidence.mjs","line":394,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/learning-capture-evidence.mjs:394"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `specPath` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contro [confidence low]","path":"scripts/harness-analysis/learning-capture-evidence.mjs","line":398,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/learning-capture-evidence.mjs:398"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html-interactions.mjs","line":135,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html-interactions.mjs:135"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html-interactions.mjs","line":279,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html-interactions.mjs:279"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":26,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:26"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":176,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:176"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":179,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:179"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":209,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:209"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":212,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:212"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":221,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:221"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":223,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:223"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":229,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:229"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":270,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:270"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":276,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:276"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":286,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:286"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":288,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:288"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":291,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:291"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":343,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:343"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":383,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:383"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":384,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:384"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":389,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:389"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":401,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:401"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":403,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:403"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":405,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:405"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":424,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:424"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":439,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:439"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":445,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:445"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":455,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:455"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":467,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:467"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":468,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:468"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":470,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:470"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":473,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:473"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":482,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:482"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":483,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:483"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":495,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:495"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":499,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:499"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":505,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:505"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":514,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:514"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":514,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:514"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":515,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:515"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":515,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:515"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":517,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:517"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":528,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:528"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":533,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:533"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":541,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:541"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":542,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:542"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":555,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:555"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":556,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:556"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":560,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:560"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":578,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:578"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":578,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:578"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":579,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:579"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":579,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:579"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/renderers/html.mjs","line":601,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/renderers/html.mjs:601"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `labels` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":239,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:239"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `section` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":262,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:262"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `label` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":435,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:435"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":492,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:492"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":524,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:524"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\s*\\|(?:\\s*:?-{3,}:?\\s*\\|)+\\s*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a lib [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":568,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/harness-analysis/report-quality.mjs:568"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `propNames` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":739,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:739"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `names` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":769,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:769"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `propName` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contro [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":804,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:804"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `heading` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":894,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/report-quality.mjs:894"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/report-quality.mjs","line":894,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/report-quality.mjs:894"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/report-run.mjs","line":25,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/report-run.mjs:25"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `dimensions` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-cont [confidence low]","path":"scripts/harness-analysis/task-loop-report.mjs","line":664,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/task-loop-report.mjs:664"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `dimensions` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-cont [confidence low]","path":"scripts/harness-analysis/task-loop-report.mjs","line":671,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/task-loop-report.mjs:671"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/task-loop-report.mjs","line":1577,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/task-loop-report.mjs:1577"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/task-loop-report.mjs","line":1578,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/task-loop-report.mjs:1578"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"scripts/harness-analysis/task-loop-report.mjs","line":1642,"fingerprint":"javascript.lang.security.insecure-object-assign:scripts/harness-analysis/task-loop-report.mjs:1642"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"scripts/harness-analysis/task-loop-report.mjs","line":2980,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/harness-analysis/task-loop-report.mjs:2980"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"scripts/harness-analysis/task-loop-report.mjs","line":4222,"fingerprint":"javascript.lang.security.insecure-object-assign:scripts/harness-analysis/task-loop-report.mjs:4222"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-analysis/task-loop-source.mjs","line":90,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-analysis/task-loop-source.mjs:90"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `labels` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"scripts/harness-analysis/validate-canvas.mjs","line":443,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/harness-analysis/validate-canvas.mjs:443"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":60,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:60"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":64,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:64"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":66,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:66"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":67,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:67"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":70,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:70"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":95,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:95"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":102,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:102"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":105,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:105"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":107,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:107"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":108,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:108"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/render-html.mjs","line":138,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/render-html.mjs:138"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/report-model.mjs","line":39,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/report-model.mjs:39"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness-inspector/report-model.mjs","line":40,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness-inspector/report-model.mjs:40"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.var-in-script-tag","severity":"medium","message":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of  [confidence low]","path":"scripts/harness-inspector/ui/workbench.html","line":42,"fingerprint":"javascript.express.security.audit.xss.mustache.var-in-script-tag:scripts/harness-inspector/ui/workbench.html:42"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.var-in-script-tag","severity":"medium","message":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of  [confidence low]","path":"scripts/harness-inspector/ui/workbench.html","line":43,"fingerprint":"javascript.express.security.audit.xss.mustache.var-in-script-tag:scripts/harness-inspector/ui/workbench.html:43"},{"rule_id":"opengrep/javascript.browser.security.raw-html-join","severity":"medium","message":"User controlled data in a HTML string may result in XSS [confidence low]","path":"scripts/harness-inspector/ui/workbench.js","line":947,"fingerprint":"javascript.browser.security.raw-html-join:scripts/harness-inspector/ui/workbench.js:947"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/host-support/profile-builders.mjs","line":118,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/host-support/profile-builders.mjs:118"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/plugin-lifecycle/runtime.mjs","line":54,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/plugin-lifecycle/runtime.mjs:54"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/plugin-lifecycle/runtime.mjs","line":60,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/plugin-lifecycle/runtime.mjs:60"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/session-analysis/analyzer.mjs","line":337,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/session-analysis/analyzer.mjs:337"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a libr [confidence low]","path":"scripts/session-analysis/claude-facets.mjs","line":639,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/session-analysis/claude-facets.mjs:639"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a libr [confidence low]","path":"scripts/session-analysis/claude-facets.mjs","line":651,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/session-analysis/claude-facets.mjs:651"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a libr [confidence low]","path":"scripts/session-analysis/claude-facets.mjs","line":671,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/session-analysis/claude-facets.mjs:671"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `command` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/session-analysis/planning-signals.mjs","line":149,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/session-analysis/planning-signals.mjs:149"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/session-analysis/platforms/codex.mjs","line":1402,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/session-analysis/platforms/codex.mjs:1402"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a libr [confidence low]","path":"scripts/session-analysis/platforms/dsh.mjs","line":1078,"fingerprint":"javascript.lang.security.audit.detect-redos:scripts/session-analysis/platforms/dsh.mjs:1078"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/session-analysis/platforms/dsh.mjs","line":2126,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/session-analysis/platforms/dsh.mjs:2126"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/session-analysis/platforms/qoder.mjs","line":2341,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/session-analysis/platforms/qoder.mjs:2341"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/session-analysis/provider-runner.mjs","line":586,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/session-analysis/provider-runner.mjs:586"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/session-analysis/selection-profile.mjs","line":21,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/session-analysis/selection-profile.mjs:21"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `candidate` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr [confidence low]","path":"scripts/task-evidence-upload/contract.mjs","line":190,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/task-evidence-upload/contract.mjs:190"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/task-evidence-upload/contract.mjs","line":213,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/task-evidence-upload/contract.mjs:213"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/task-evidence-upload/contract.mjs","line":219,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/task-evidence-upload/contract.mjs:219"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/task-evidence-upload/contract.mjs","line":225,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/task-evidence-upload/contract.mjs:225"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/task-evidence-upload/contract.mjs","line":231,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/task-evidence-upload/contract.mjs:231"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/workspace-topology/manifests.mjs","line":47,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/workspace-topology/manifests.mjs:47"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/workspace-topology/manifests.mjs","line":101,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/workspace-topology/manifests.mjs:101"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"skills/intent-correlation-analysis/scripts/validate-analysis.mjs","line":151,"fingerprint":"javascript.lang.security.html-in-template-string:skills/intent-correlation-analysis/scripts/validate-analysis.mjs:151"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"skills/intent-correlation-analysis/scripts/validate-analysis.mjs","line":171,"fingerprint":"javascript.lang.security.html-in-template-string:skills/intent-correlation-analysis/scripts/validate-analysis.mjs:171"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"skills/intent-correlation-analysis/scripts/validate-analysis.mjs","line":213,"fingerprint":"javascript.lang.security.html-in-template-string:skills/intent-correlation-analysis/scripts/validate-analysis.mjs:213"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/fence.rs","line":194,"fingerprint":"rust.lang.security.temp-dir:packages/better-harness-desktop/rust/acp-host/src/fence.rs:194"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":66,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:66"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":73,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:73"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":178,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:178"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":205,"fingerprint":"rust.lang.security.current-exe:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:205"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":224,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:224"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":256,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:256"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":298,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:298"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":308,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:308"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":353,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:353"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":379,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:379"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/acp-host/src/xpc.rs","line":405,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/acp-host/src/xpc.rs:405"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/arch-service/src/xpc.rs","line":35,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/arch-service/src/xpc.rs:35"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/arch-service/src/xpc.rs","line":39,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/arch-service/src/xpc.rs:39"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/arch-service/src/xpc.rs","line":123,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/arch-service/src/xpc.rs:123"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"packages/better-harness-desktop/rust/arch-service/src/xpc.rs","line":149,"fingerprint":"rust.lang.security.current-exe:packages/better-harness-desktop/rust/arch-service/src/xpc.rs:149"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/arch-service/src/xpc.rs","line":170,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/arch-service/src/xpc.rs:170"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/arch-service/src/xpc.rs","line":193,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/arch-service/src/xpc.rs:193"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/better-harness-desktop/rust/arch-service/src/xpc.rs","line":230,"fingerprint":"rust.lang.security.unsafe-usage:packages/better-harness-desktop/rust/arch-service/src/xpc.rs:230"}],"evidence":[],"data":{"rulesets":["javascript","typescript","rust","go","c"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":64.0,"vulnerabilities":199.0,"vulns_critical":10.0,"vulns_high":48.0,"vulns_medium":87.0,"vulns_low":19.0,"vulns_unknown":35.0,"penalty":375.0},"findings":[{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-pqg4-j6r4-53mv","severity":"critical","message":"shell-quote@1.10.0 (npm) is affected by GHSA-pqg4-j6r4-53mv","path":"docs/package-lock.json","line":null,"fingerprint":"shell-quote@1.10.0 (npm):GHSA-pqg4-j6r4-53mv"},{"rule_id":"osv/GHSA-5gmw-xhrv-c9v3","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3","path":"docs/package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-5gmw-xhrv-c9v3"},{"rule_id":"osv/GHSA-85c8-ppgw-ccpr","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr","path":"docs/package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-85c8-ppgw-ccpr"},{"rule_id":"osv/GHSA-8r5x-fm3f-whwj","severity":"critical","message":"handlebars@4.7.9 (npm) is affected by GHSA-8r5x-fm3f-whwj","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.9 (npm):GHSA-8r5x-fm3f-whwj"},{"rule_id":"osv/GHSA-p8wg-vrv2-v86f","severity":"critical","message":"handlebars@4.7.9 (npm) is affected by GHSA-p8wg-vrv2-v86f","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.9 (npm):GHSA-p8wg-vrv2-v86f"},{"rule_id":"osv/GHSA-2464-fhr4-w9xw","severity":"critical","message":"next@16.3.6 (npm) is affected by GHSA-2464-fhr4-w9xw","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-2464-fhr4-w9xw"},{"rule_id":"osv/GHSA-673q-mjm6-r5xr","severity":"critical","message":"next@16.3.6 (npm) is affected by GHSA-673q-mjm6-r5xr","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-673q-mjm6-r5xr"},{"rule_id":"osv/RUSTSEC-2026-0327","severity":"critical","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0327","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0327"},{"rule_id":"osv/GHSA-mghf-wjfp-p5xm","severity":"critical","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0379, GHSA-mghf-wjfp-p5xm","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):GHSA-mghf-wjfp-p5xm"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@1.20.6 (npm) is affected by GHSA-27r3-jxmh-p828","path":"docs/package-lock.json","line":null,"fingerprint":"body-parser@1.20.6 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-qhr7-859c-m2p7; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-vc2v-76pw-4v95","severity":"high","message":"compression@1.8.1 (npm) is affected by GHSA-vc2v-76pw-4v95","path":"docs/package-lock.json","line":null,"fingerprint":"compression@1.8.1 (npm):GHSA-vc2v-76pw-4v95"},{"rule_id":"osv/GHSA-8r9p-f939-6h3c","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-8r9p-f939-6h3c","path":"docs/package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-8r9p-f939-6h3c"},{"rule_id":"osv/GHSA-mrwp-f3q8-3g9p","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-mrwp-f3q8-3g9p","path":"docs/package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-mrwp-f3q8-3g9p"},{"rule_id":"osv/GHSA-q3jh-wrc6-jgq8","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-q3jh-wrc6-jgq8","path":"docs/package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-q3jh-wrc6-jgq8"},{"rule_id":"osv/GHSA-4528-x5fx-h6hg","severity":"high","message":"joi@17.13.4 (npm) is affected by GHSA-4528-x5fx-h6hg","path":"docs/package-lock.json","line":null,"fingerprint":"joi@17.13.4 (npm):GHSA-4528-x5fx-h6hg"},{"rule_id":"osv/GHSA-6h2x-m376-mqjq","severity":"high","message":"joi@17.13.4 (npm) is affected by GHSA-6h2x-m376-mqjq","path":"docs/package-lock.json","line":null,"fingerprint":"joi@17.13.4 (npm):GHSA-6h2x-m376-mqjq"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.3.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"docs/package-lock.json","line":null,"fingerprint":"js-yaml@4.3.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"launch-editor@2.14.1 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"docs/package-lock.json","line":null,"fingerprint":"launch-editor@2.14.1 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-w27v-7q3p-w38r","severity":"high","message":"svgo@3.3.4 (npm) is affected by GHSA-w27v-7q3p-w38r","path":"docs/package-lock.json","line":null,"fingerprint":"svgo@3.3.4 (npm):GHSA-w27v-7q3p-w38r"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.29.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.29.0 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.29.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@7.29.0 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-w293-vg96-wgc3","severity":"high","message":"undici@7.29.0 (npm) is affected by GHSA-w293-vg96-wgc3","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-w293-vg96-wgc3"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.29.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-g84c-rxfj-3j2c","severity":"high","message":"webpack-dev-middleware@7.4.5 (npm) is affected by GHSA-g84c-rxfj-3j2c","path":"docs/package-lock.json","line":null,"fingerprint":"webpack-dev-middleware@7.4.5 (npm):GHSA-g84c-rxfj-3j2c"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-22jm-h49p-29qw","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-46jr-4wx8-v453","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-f897-62hf-6gxq","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.3.0 (npm) is affected by GHSA-27r3-jxmh-p828","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.3.0 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-jr5w-w6x2-84p9","severity":"high","message":"electron@44.4.2 (npm) is affected by GHSA-jr5w-w6x2-84p9","path":"package-lock.json","line":null,"fingerprint":"electron@44.4.2 (npm):GHSA-jr5w-w6x2-84p9"},{"rule_id":"osv/GHSA-cjq9-62q9-8jv4","severity":"high","message":"next@16.3.6 (npm) is affected by GHSA-cjq9-62q9-8jv4","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-cjq9-62q9-8jv4"},{"rule_id":"osv/GHSA-p3m5-59mp-jv5r","severity":"high","message":"next@16.3.6 (npm) is affected by GHSA-p3m5-59mp-jv5r","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-p3m5-59mp-jv5r"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.35.4 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"package-lock.json","line":null,"fingerprint":"sharp@0.35.4 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@6.28.1 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@6.28.1 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@6.28.1 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.2.2 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.4.3 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.4.3 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/RUSTSEC-2026-0340","severity":"high","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0340","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0340"},{"rule_id":"osv/RUSTSEC-2026-0343","severity":"high","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0343","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0343"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-2wm5-q62r-hmrv","severity":"medium","message":"colord@2.9.3 (npm) is affected by GHSA-2wm5-q62r-hmrv","path":"docs/package-lock.json","line":null,"fingerprint":"colord@2.9.3 (npm):GHSA-2wm5-q62r-hmrv"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"docs/package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.7 (npm) is affected by GHSA-hrr3-gc8f-f4qj; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.7 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.7 (npm) is affected by GHSA-w74x-v6f9-j3xg; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.7 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@3.1.7 (npm) is affected by GHSA-wjr9-j795-jxcr; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.7 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-wr44-6hxh-3jwq","severity":"medium","message":"joi@17.13.4 (npm) is affected by GHSA-wr44-6hxh-3jwq","path":"docs/package-lock.json","line":null,"fingerprint":"joi@17.13.4 (npm):GHSA-wr44-6hxh-3jwq"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"launch-editor@2.14.1 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"docs/package-lock.json","line":null,"fingerprint":"launch-editor@2.14.1 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"launch-editor@2.14.1 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"docs/package-lock.json","line":null,"fingerprint":"launch-editor@2.14.1 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@6.1.4 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"docs/package-lock.json","line":null,"fingerprint":"postcss-selector-parser@6.1.4 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@7.1.4 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"docs/package-lock.json","line":null,"fingerprint":"postcss-selector-parser@7.1.4 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.16.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"qs@6.16.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-4vpr-x523-8j87","severity":"medium","message":"svgo@3.3.4 (npm) is affected by GHSA-4vpr-x523-8j87","path":"docs/package-lock.json","line":null,"fingerprint":"svgo@3.3.4 (npm):GHSA-4vpr-x523-8j87"},{"rule_id":"osv/GHSA-2jfj-6hjv-fm6j","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-2jfj-6hjv-fm6j","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-2jfj-6hjv-fm6j"},{"rule_id":"osv/GHSA-3wwx-pv8p-q78v","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-3wwx-pv8p-q78v","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-3wwx-pv8p-q78v"},{"rule_id":"osv/GHSA-3xpg-4rpp-hhhm","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-3xpg-4rpp-hhhm","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-3xpg-4rpp-hhhm"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-f72v-6w45-q472","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-pmjh-fq2x-6v4x","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-pmjh-fq2x-6v4x","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-pmjh-fq2x-6v4x"},{"rule_id":"osv/GHSA-rx4f-c7p8-82vq","severity":"medium","message":"undici@7.29.0 (npm) is affected by GHSA-rx4f-c7p8-82vq","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-rx4f-c7p8-82vq"},{"rule_id":"osv/GHSA-vh25-5764-9wcr","severity":"medium","message":"@conventional-changelog/git-client@1.0.1 (npm) is affected by GHSA-vh25-5764-9wcr","path":"package-lock.json","line":null,"fingerprint":"@conventional-changelog/git-client@1.0.1 (npm):GHSA-vh25-5764-9wcr"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@2.1.1 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@2.1.1 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-qv5m-9pm6-hqp3","severity":"medium","message":"@hono/node-server@2.1.1 (npm) is affected by GHSA-qv5m-9pm6-hqp3","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@2.1.1 (npm):GHSA-qv5m-9pm6-hqp3"},{"rule_id":"osv/GHSA-rmxm-3fg6-px4f","severity":"medium","message":"@hono/node-server@2.1.1 (npm) is affected by GHSA-rmxm-3fg6-px4f","path":"package-lock.json","line":null,"fingerprint":"@hono/node-server@2.1.1 (npm):GHSA-rmxm-3fg6-px4f"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.30.0 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"package-lock.json","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.30.0 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.11 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.11 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-xp26-3454-mjgp","severity":"medium","message":"@vitest/mocker@4.1.11 (npm) is affected by GHSA-xp26-3454-mjgp","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.11 (npm):GHSA-xp26-3454-mjgp"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-x562-297c-g43g","severity":"medium","message":"electron@44.4.2 (npm) is affected by GHSA-x562-297c-g43g","path":"package-lock.json","line":null,"fingerprint":"electron@44.4.2 (npm):GHSA-x562-297c-g43g"},{"rule_id":"osv/GHSA-xw65-4hp5-5hc7","severity":"medium","message":"handlebars@4.7.9 (npm) is affected by GHSA-xw65-4hp5-5hc7","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.9 (npm):GHSA-xw65-4hp5-5hc7"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-46wx-v44x-9hh2","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-4h7h-rv7c-7m2v","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-4m76-xfj5-7975","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-5r4p-p66f-jhc7","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-5r4p-p66f-jhc7","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-5r4p-p66f-jhc7"},{"rule_id":"osv/GHSA-crvj-82cr-hjcx","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-crvj-82cr-hjcx","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-crvj-82cr-hjcx"},{"rule_id":"osv/GHSA-g6gw-c38x-mqfc","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-g6gw-c38x-mqfc","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-g6gw-c38x-mqfc"},{"rule_id":"osv/GHSA-gqvv-2mrq-wpjv","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-gqvv-2mrq-wpjv","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-gqvv-2mrq-wpjv"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-h7mg-cq63-vhpq","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-hxh3-vqpv-xpqv","severity":"medium","message":"hono@4.13.2 (npm) is affected by GHSA-hxh3-vqpv-xpqv","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-hxh3-vqpv-xpqv"},{"rule_id":"osv/GHSA-2vr4-cq9g-pvrc","severity":"medium","message":"ip-address@10.5.0 (npm) is affected by GHSA-2vr4-cq9g-pvrc","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.5.0 (npm):GHSA-2vr4-cq9g-pvrc"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.5.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.5.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.5.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.5.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.5.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.5.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.5.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.5.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-39w2-rjm5-chcv","severity":"medium","message":"next@16.3.6 (npm) is affected by GHSA-39w2-rjm5-chcv","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-39w2-rjm5-chcv"},{"rule_id":"osv/GHSA-3w37-wq28-93x7","severity":"medium","message":"next@16.3.6 (npm) is affected by GHSA-3w37-wq28-93x7","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-3w37-wq28-93x7"},{"rule_id":"osv/GHSA-4jqv-mc3x-m676","severity":"medium","message":"next@16.3.6 (npm) is affected by GHSA-4jqv-mc3x-m676","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-4jqv-mc3x-m676"},{"rule_id":"osv/GHSA-f87g-xv8r-7p7x","severity":"medium","message":"next@16.3.6 (npm) is affected by GHSA-f87g-xv8r-7p7x","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-f87g-xv8r-7p7x"},{"rule_id":"osv/GHSA-h694-7cp9-m8p3","severity":"medium","message":"next@16.3.6 (npm) is affected by GHSA-h694-7cp9-m8p3","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-h694-7cp9-m8p3"},{"rule_id":"osv/GHSA-mcj8-r9mp-w47p","severity":"medium","message":"next@16.3.6 (npm) is affected by GHSA-mcj8-r9mp-w47p","path":"package-lock.json","line":null,"fingerprint":"next@16.3.6 (npm):GHSA-mcj8-r9mp-w47p"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@6.28.1 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@6.28.1 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@6.28.1 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-f72v-6w45-q472","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-f72v-6w45-q472","path":"package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-vfpm-58rq-9qcg","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-vfpm-58rq-9qcg","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-vfpm-58rq-9qcg"},{"rule_id":"osv/GO-2026-5024","severity":"medium","message":"golang.org/x/sys@0.0.0-20220715151400-c0bba94af5f8 (Go) is affected by GO-2026-5024","path":"packages/better-harness-desktop/go/esbuild-service/go.mod","line":null,"fingerprint":"golang.org/x/sys@0.0.0-20220715151400-c0bba94af5f8 (Go):GO-2026-5024"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486; also in packages/better-harness-desktop/rust/box-service/Cargo.lock; also in packages/better-harness-desktop/rust/diff-service/Cargo.lock; also in packages/better-harness-desktop/rust/ontology-service/Cargo.lock","path":"packages/better-harness-desktop/rust/acp-host/Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.53.1 (crates.io) is affected by RUSTSEC-2026-0386; also in packages/better-harness-desktop/rust/box-service/Cargo.lock; also in packages/better-harness-desktop/rust/chart-runtime/Cargo.lock; also in packages/better-harness-desktop/rust/pty-service/Cargo.lock","path":"packages/better-harness-desktop/rust/acp-host/Cargo.lock","line":null,"fingerprint":"tokio@1.53.1 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2025-0056","severity":"medium","message":"adler@1.0.2 (crates.io) is affected by RUSTSEC-2025-0056","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"adler@1.0.2 (crates.io):RUSTSEC-2025-0056"},{"rule_id":"osv/GHSA-g98v-hv3f-hcfr","severity":"medium","message":"atty@0.2.14 (crates.io) is affected by RUSTSEC-2021-0145, GHSA-g98v-hv3f-hcfr","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"atty@0.2.14 (crates.io):GHSA-g98v-hv3f-hcfr"},{"rule_id":"osv/RUSTSEC-2024-0375","severity":"medium","message":"atty@0.2.14 (crates.io) is affected by RUSTSEC-2024-0375","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"atty@0.2.14 (crates.io):RUSTSEC-2024-0375"},{"rule_id":"osv/RUSTSEC-2025-0141","severity":"medium","message":"bincode@1.3.3 (crates.io) is affected by RUSTSEC-2025-0141","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"bincode@1.3.3 (crates.io):RUSTSEC-2025-0141"},{"rule_id":"osv/RUSTSEC-2025-0141","severity":"medium","message":"bincode@2.0.1 (crates.io) is affected by RUSTSEC-2025-0141","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"bincode@2.0.1 (crates.io):RUSTSEC-2025-0141"},{"rule_id":"osv/RUSTSEC-2016-0007","severity":"medium","message":"jwt@0.16.0 (crates.io) is affected by RUSTSEC-2016-0007","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"jwt@0.16.0 (crates.io):RUSTSEC-2016-0007"},{"rule_id":"osv/RUSTSEC-2026-0459","severity":"medium","message":"libsqlite3-sys@0.37.0 (crates.io) is affected by RUSTSEC-2026-0459","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"libsqlite3-sys@0.37.0 (crates.io):RUSTSEC-2026-0459"},{"rule_id":"osv/RUSTSEC-2026-0441","severity":"medium","message":"pin-utils@0.1.0 (crates.io) is affected by RUSTSEC-2026-0441","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"pin-utils@0.1.0 (crates.io):RUSTSEC-2026-0441"},{"rule_id":"osv/RUSTSEC-2026-0338","severity":"medium","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0338","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0338"},{"rule_id":"osv/RUSTSEC-2026-0523","severity":"medium","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0523","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0523"},{"rule_id":"osv/RUSTSEC-2026-0524","severity":"medium","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0524","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0524"},{"rule_id":"osv/RUSTSEC-2026-0538","severity":"medium","message":"quinn-udp@0.5.15 (crates.io) is affected by RUSTSEC-2026-0538","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"quinn-udp@0.5.15 (crates.io):RUSTSEC-2026-0538"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.44 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"rustls@0.23.44 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.44 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"rustls@0.23.44 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.15 (crates.io) is affected by RUSTSEC-2026-0382","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.15 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2020-0163","severity":"medium","message":"term_size@0.3.2 (crates.io) is affected by RUSTSEC-2020-0163","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"term_size@0.3.2 (crates.io):RUSTSEC-2020-0163"},{"rule_id":"osv/RUSTSEC-2026-0381","severity":"medium","message":"webpki-roots@1.0.9 (crates.io) is affected by RUSTSEC-2026-0381","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"webpki-roots@1.0.9 (crates.io):RUSTSEC-2026-0381"},{"rule_id":"osv/RUSTSEC-2026-0391","severity":"medium","message":"zstd@0.13.3 (crates.io) is affected by RUSTSEC-2026-0391; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd@0.13.3 (crates.io):RUSTSEC-2026-0391"},{"rule_id":"osv/RUSTSEC-2026-0395","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0395; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0395"},{"rule_id":"osv/RUSTSEC-2026-0396","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0396; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0396"},{"rule_id":"osv/RUSTSEC-2026-0397","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0397; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0397"},{"rule_id":"osv/RUSTSEC-2026-0398","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0398; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0398"},{"rule_id":"osv/RUSTSEC-2026-0399","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0399; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0399"},{"rule_id":"osv/RUSTSEC-2026-0400","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0400; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0400"},{"rule_id":"osv/RUSTSEC-2026-0401","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0401; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0401"},{"rule_id":"osv/RUSTSEC-2026-0402","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0402; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0402"},{"rule_id":"osv/RUSTSEC-2026-0403","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0403; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0403"},{"rule_id":"osv/RUSTSEC-2026-0404","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0404; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0404"},{"rule_id":"osv/RUSTSEC-2026-0405","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0405; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0405"},{"rule_id":"osv/RUSTSEC-2026-0406","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0406; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0406"},{"rule_id":"osv/RUSTSEC-2026-0410","severity":"medium","message":"zstd-sys@2.1.0+zstd.1.5.7 (crates.io) is affected by RUSTSEC-2026-0410; also in packages/better-harness-desktop/rust/evidence-host/Cargo.lock","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"zstd-sys@2.1.0+zstd.1.5.7 (crates.io):RUSTSEC-2026-0410"},{"rule_id":"osv/RUSTSEC-2026-0442","severity":"medium","message":"arrow-data@58.4.0 (crates.io) is affected by RUSTSEC-2026-0442","path":"packages/better-harness-desktop/rust/chart-runtime/Cargo.lock","line":null,"fingerprint":"arrow-data@58.4.0 (crates.io):RUSTSEC-2026-0442"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"packages/better-harness-desktop/rust/chart-runtime/Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0315","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0315","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0315"},{"rule_id":"osv/RUSTSEC-2026-0325","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0325","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0325"},{"rule_id":"osv/RUSTSEC-2026-0326","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0326","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0326"},{"rule_id":"osv/RUSTSEC-2026-0353","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0353","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0353"},{"rule_id":"osv/RUSTSEC-2026-0354","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0354","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0354"},{"rule_id":"osv/RUSTSEC-2026-0355","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0355","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0355"},{"rule_id":"osv/RUSTSEC-2026-0356","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0356","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0356"},{"rule_id":"osv/RUSTSEC-2026-0357","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0357","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0357"},{"rule_id":"osv/RUSTSEC-2026-0358","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0358","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0358"},{"rule_id":"osv/RUSTSEC-2026-0359","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0359","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0359"},{"rule_id":"osv/RUSTSEC-2026-0361","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0361","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0361"},{"rule_id":"osv/RUSTSEC-2026-0362","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0362","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0362"},{"rule_id":"osv/RUSTSEC-2026-0363","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0363","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0363"},{"rule_id":"osv/GHSA-9pvw-hwfg-92h5","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0378, GHSA-9pvw-hwfg-92h5","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):GHSA-9pvw-hwfg-92h5"},{"rule_id":"osv/RUSTSEC-2026-0423","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0423","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0423"},{"rule_id":"osv/RUSTSEC-2026-0424","severity":"medium","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0424","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0424"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.7 (npm) is affected by GHSA-333x-w4r6-6crp; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.7 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.7 (npm) is affected by GHSA-xhq7-xmqj-769h; also in package-lock.json","path":"docs/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.7 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-6w3j-5fw6-r9vr","severity":"low","message":"joi@17.13.4 (npm) is affected by GHSA-6w3j-5fw6-r9vr","path":"docs/package-lock.json","line":null,"fingerprint":"joi@17.13.4 (npm):GHSA-6w3j-5fw6-r9vr"},{"rule_id":"osv/GHSA-gg4h-3hg2-grpc","severity":"low","message":"joi@17.13.4 (npm) is affected by GHSA-gg4h-3hg2-grpc","path":"docs/package-lock.json","line":null,"fingerprint":"joi@17.13.4 (npm):GHSA-gg4h-3hg2-grpc"},{"rule_id":"osv/GHSA-m5mm-p8h7-m29v","severity":"low","message":"serialize-javascript@7.0.7 (npm) is affected by GHSA-m5mm-p8h7-m29v","path":"docs/package-lock.json","line":null,"fingerprint":"serialize-javascript@7.0.7 (npm):GHSA-m5mm-p8h7-m29v"},{"rule_id":"osv/GHSA-2gqq-gqf2-x968","severity":"low","message":"undici@7.29.0 (npm) is affected by GHSA-2gqq-gqf2-x968","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-2gqq-gqf2-x968"},{"rule_id":"osv/GHSA-8436-99hf-9mmv","severity":"low","message":"undici@7.29.0 (npm) is affected by GHSA-8436-99hf-9mmv","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-8436-99hf-9mmv"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@7.29.0 (npm) is affected by GHSA-r53p-7pc4-xj5r","path":"docs/package-lock.json","line":null,"fingerprint":"undici@7.29.0 (npm):GHSA-r53p-7pc4-xj5r"},{"rule_id":"osv/GHSA-3qxv-5xgr-q7w9","severity":"low","message":"electron@44.4.2 (npm) is affected by GHSA-3qxv-5xgr-q7w9","path":"package-lock.json","line":null,"fingerprint":"electron@44.4.2 (npm):GHSA-3qxv-5xgr-q7w9"},{"rule_id":"osv/GHSA-h3v5-h239-pg29","severity":"low","message":"electron@44.4.2 (npm) is affected by GHSA-h3v5-h239-pg29","path":"package-lock.json","line":null,"fingerprint":"electron@44.4.2 (npm):GHSA-h3v5-h239-pg29"},{"rule_id":"osv/GHSA-474x-hrwr-fgx4","severity":"low","message":"fast-xml-parser@5.11.1 (npm) is affected by GHSA-474x-hrwr-fgx4","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@5.11.1 (npm):GHSA-474x-hrwr-fgx4"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.13.2 (npm) is affected by GHSA-3gg2-335m-rxc6","path":"package-lock.json","line":null,"fingerprint":"hono@4.13.2 (npm):GHSA-3gg2-335m-rxc6"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.2.2 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-9jrq-w75r-8gcw"},{"rule_id":"osv/GHSA-vp88-798v-h67f","severity":"low","message":"rustls@0.23.44 (crates.io) is affected by RUSTSEC-2026-0347, GHSA-vp88-798v-h67f","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"rustls@0.23.44 (crates.io):GHSA-vp88-798v-h67f"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.44 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"rustls@0.23.44 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.44 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"packages/better-harness-desktop/rust/box-service/Cargo.lock","line":null,"fingerprint":"rustls@0.23.44 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/RUSTSEC-2026-0316","severity":"low","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0316","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0316"},{"rule_id":"osv/RUSTSEC-2026-0364","severity":"low","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0364","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0364"},{"rule_id":"osv/RUSTSEC-2026-0422","severity":"low","message":"wasmtime@48.0.1 (crates.io) is affected by RUSTSEC-2026-0422","path":"packages/better-harness-desktop/rust/ontology-service/Cargo.lock","line":null,"fingerprint":"wasmtime@48.0.1 (crates.io):RUSTSEC-2026-0422"}],"evidence":[],"data":{"ecosystems":["Go","crates.io","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":5.0,"findings":39.0,"findings_high":31.0,"findings_medium":2.0,"findings_low":6.0,"penalty":341.7},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/better-harness-desktop.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/better-harness-desktop.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/better-harness-desktop.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/better-harness-desktop.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/better-harness-desktop.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/better-harness-desktop.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/better-harness-desktop.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/better-harness-desktop.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/better-harness-desktop.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/better-harness-desktop.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":34,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:34"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":59,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:59"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":77,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:77"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/pages.yml","line":17,"fingerprint":"excessive-permissions:.github/workflows/pages.yml:17"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/pages.yml","line":18,"fingerprint":"excessive-permissions:.github/workflows/pages.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:40"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":41,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:41"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":53,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:53"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/release.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/release.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":49,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":71,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:71"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":88,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:88"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":92,"fingerprint":"unpinned-uses:.github/workflows/studio-desktop-release.yml:92"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/studio-desktop-release.yml","line":28,"fingerprint":"cache-poisoning:.github/workflows/studio-desktop-release.yml:28"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/studio-desktop-release.yml","line":32,"fingerprint":"cache-poisoning:.github/workflows/studio-desktop-release.yml:32"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/studio-desktop-release.yml","line":39,"fingerprint":"cache-poisoning:.github/workflows/studio-desktop-release.yml:39"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/studio-desktop-release.yml","line":49,"fingerprint":"cache-poisoning:.github/workflows/studio-desktop-release.yml:49"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/better-harness-desktop.yml","line":23,"fingerprint":"artipacked:.github/workflows/better-harness-desktop.yml:23"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/pages.yml","line":28,"fingerprint":"artipacked:.github/workflows/pages.yml:28"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":33,"fingerprint":"artipacked:.github/workflows/ci.yml:33"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":26,"fingerprint":"artipacked:.github/workflows/release.yml:26"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/studio-desktop-release.yml","line":27,"fingerprint":"artipacked:.github/workflows/studio-desktop-release.yml:27"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":39,"fingerprint":"template-injection:.github/workflows/release.yml:39"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":44,"fingerprint":"template-injection:.github/workflows/release.yml:44"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/studio-desktop-release.yml","line":92,"fingerprint":"superfluous-actions:.github/workflows/studio-desktop-release.yml:92"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.13,"unpinned_manifests":5.0},"findings":[],"evidence":[{"kind":"posture","description":"packages/better-harness-desktop/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/better-harness-desktop/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/harness-studio-apps/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/harness-studio-apps/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/harness-studio/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/harness-studio/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/harness-ui/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/harness-ui/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/harness/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/harness/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":3.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.7.0-alpha2 ships Harness.Studio-0.1.0-arm64-mac.zip (12 downloads)","ref":"Harness.Studio-0.1.0-arm64-mac.zip","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio-0.1.0-arm64-mac.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v0.7.0-alpha2 ships Harness.Studio-0.1.0.AppImage (7 downloads)","ref":"Harness.Studio-0.1.0.AppImage","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio-0.1.0.AppImage","weight":0.0},{"kind":"binary-release-asset","description":"release v0.7.0-alpha2 ships Harness.Studio.Setup.0.1.0.exe (15 downloads)","ref":"Harness.Studio.Setup.0.1.0.exe","url":"https://github.com/QoderAI/better-harness/releases/download/v0.7.0-alpha2/Harness.Studio.Setup.0.1.0.exe","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":16913.0,"function_nloc":174855.0,"mean_ccn":3.82,"p90_ccn":9.0,"complex_functions":618.0,"long_functions":139.0,"many_param_functions":16.0,"risky_nloc_share":0.2849},"findings":[],"evidence":[{"kind":"complex-function","description":"validateTaskLoopFindings in scripts/harness-analysis/task-loop-report.mjs: complexity 417, 744 lines","ref":"scripts/harness-analysis/task-loop-report.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/harness-analysis/task-loop-report.mjs#L3439","weight":1.0},{"kind":"complex-function","description":"route in packages/harness-studio/src/server/server.ts: complexity 246, 528 lines","ref":"packages/harness-studio/src/server/server.ts","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/harness-studio/src/server/server.ts#L255","weight":1.0},{"kind":"complex-function","description":"evaluateTaskLoopCanvasQuality in scripts/harness-analysis/validate-canvas.mjs: complexity 223, 330 lines","ref":"scripts/harness-analysis/validate-canvas.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/harness-analysis/validate-canvas.mjs#L98","weight":1.0},{"kind":"complex-function","description":"validateSequence in scripts/session-analysis/platforms/dsh.mjs: complexity 135, 212 lines","ref":"scripts/session-analysis/platforms/dsh.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/session-analysis/platforms/dsh.mjs#L1594","weight":1.0},{"kind":"complex-function","description":"summarizeSessionEvents in scripts/commit-session-link/session-source.mjs: complexity 128, 226 lines","ref":"scripts/commit-session-link/session-source.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/commit-session-link/session-source.mjs#L218","weight":1.0},{"kind":"complex-function","description":"normalizeEvent in scripts/session-analysis/platforms/codex.mjs: complexity 114, 189 lines","ref":"scripts/session-analysis/platforms/codex.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/session-analysis/platforms/codex.mjs#L905","weight":1.0},{"kind":"complex-function","description":"normalizeEvent in scripts/session-analysis/platforms/qoder.mjs: complexity 103, 211 lines","ref":"scripts/session-analysis/platforms/qoder.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/session-analysis/platforms/qoder.mjs#L1508","weight":1.0},{"kind":"complex-function","description":"validateKnownUnsupportedEvent in scripts/session-analysis/platforms/dsh.mjs: complexity 94, 140 lines","ref":"scripts/session-analysis/platforms/dsh.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/session-analysis/platforms/dsh.mjs#L709","weight":1.0},{"kind":"complex-function","description":"transcriptEvents in scripts/session-analysis/platforms/copilot.mjs: complexity 91, 235 lines","ref":"scripts/session-analysis/platforms/copilot.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/session-analysis/platforms/copilot.mjs#L116","weight":1.0},{"kind":"complex-function","description":"workspaceTopologyErrors in scripts/workspace-topology/contract.mjs: complexity 84, 162 lines","ref":"scripts/workspace-topology/contract.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/scripts/workspace-topology/contract.mjs#L96","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":171974.0,"duplicated_lines":9538.0,"duplicated_share":0.0555,"files":943.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: dev/html-preview.mjs:13 and scripts/harness-analysis/canvas-preview/server.mjs:16","ref":"dev/html-preview.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/dev/html-preview.mjs#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: dev/html-preview.mjs:62 and scripts/harness-analysis/canvas-preview/cli.mjs:49","ref":"dev/html-preview.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/dev/html-preview.mjs#L62","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/src/pages/inspector/index.js:204 and docs/src/pages/inspector/index.js:219","ref":"docs/src/pages/inspector/index.js","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/docs/src/pages/inspector/index.js#L204","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/git-scripts/blast-radius.mjs:13 and scripts/better-harness.mjs:12","ref":"hooks/git-scripts/blast-radius.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/hooks/git-scripts/blast-radius.mjs#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/git-scripts/blast-radius/analysis.mjs:34 and hooks/git-scripts/blast-radius/analysis.mjs:343","ref":"hooks/git-scripts/blast-radius/analysis.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/hooks/git-scripts/blast-radius/analysis.mjs#L34","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/git-scripts/blast-radius/analysis.mjs:122 and scripts/review-trigger/cli.mjs:126","ref":"hooks/git-scripts/blast-radius/analysis.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/hooks/git-scripts/blast-radius/analysis.mjs#L122","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/git-scripts/blast-radius/config.mjs:84 and scripts/core-change-watch/common.mjs:24","ref":"hooks/git-scripts/blast-radius/config.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/hooks/git-scripts/blast-radius/config.mjs#L84","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/git-scripts/blast-radius/hook.mjs:7 and hooks/git-scripts/test-mapping/core.mjs:17","ref":"hooks/git-scripts/blast-radius/hook.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/hooks/git-scripts/blast-radius/hook.mjs#L7","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: hooks/git-scripts/blast-radius/utils.mjs:42 and scripts/core-change-watch/common.mjs:166","ref":"hooks/git-scripts/blast-radius/utils.mjs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/hooks/git-scripts/blast-radius/utils.mjs#L42","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/better-harness-desktop/rust/acp-host/src/connection.rs:375 and packages/better-harness-desktop/rust/acp-host/src/connection.rs:392","ref":"packages/better-harness-desktop/rust/acp-host/src/connection.rs","url":"https://github.com/QoderAI/better-harness/blob/c6240a808923630db9d6397ced789eab509f0f66/packages/better-harness-desktop/rust/acp-host/src/connection.rs#L375","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":445.0,"weighted_findings":261.75,"scanned_lines":226272.0,"category:best-practice":66.0,"category:correctness":379.0},"findings":[{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how definition.id === candidateId is evaluated, this expression returns \"Candidate\". This is probably a copy-paste error.","path":"packages/harness-studio/src/app/experiment/experiment-comparison-model.ts","line":252,"fingerprint":"typescript.lang.correctness.useless-ternary:packages/harness-studio/src/app/experiment/experiment-comparison-model.ts:252"},{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how target.kind === \"resolved\" is evaluated, this expression returns relId(target.file). This is probably a copy-paste error.","path":"scripts/doc-link-graph/cli.mjs","line":145,"fingerprint":"typescript.lang.correctness.useless-ternary:scripts/doc-link-graph/cli.mjs:145"},{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how locale === \"zh-CN\" is evaluated, this expression returns \"Skills\". This is probably a copy-paste error.","path":"scripts/harness-analysis/task-loop-report.mjs","line":1177,"fingerprint":"typescript.lang.correctness.useless-ternary:scripts/harness-analysis/task-loop-report.mjs:1177"},{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how data.mode === \"normal\" is evaluated, this expression returns []. This is probably a copy-paste error.","path":"scripts/session-analysis/platforms/dsh.mjs","line":1112,"fingerprint":"typescript.lang.correctness.useless-ternary:scripts/session-analysis/platforms/dsh.mjs:1112"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/src/theme/BlogListPage/index.js","line":52,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/src/theme/BlogListPage/index.js:52"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/src/theme/BlogListPage/index.js","line":53,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/src/theme/BlogListPage/index.js:53"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/src/theme/BlogListPage/index.js","line":54,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/src/theme/BlogListPage/index.js:54"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"hooks/git-scripts/blast-radius/languages/python.mjs","line":6,"fingerprint":"javascript.lang.correctness.no-replaceall:hooks/git-scripts/blast-radius/languages/python.mjs:6"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"hooks/git-scripts/blast-radius/languages/python.mjs","line":49,"fingerprint":"javascript.lang.correctness.no-replaceall:hooks/git-scripts/blast-radius/languages/python.mjs:49"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"hooks/git-scripts/blast-radius/utils.mjs","line":31,"fingerprint":"javascript.lang.correctness.no-replaceall:hooks/git-scripts/blast-radius/utils.mjs:31"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"hooks/git-scripts/test-mapping/core.mjs","line":79,"fingerprint":"javascript.lang.correctness.no-replaceall:hooks/git-scripts/test-mapping/core.mjs:79"},{"rule_id":"opengrep/go.lang.correctness.use-filepath-join","severity":"medium","message":"`path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators.","path":"packages/better-harness-desktop/go/esbuild-service/linker/linker.go","line":123,"fingerprint":"go.lang.correctness.use-filepath-join:packages/better-harness-desktop/go/esbuild-service/linker/linker.go:123"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"packages/harness-studio/scripts/dev.mjs","line":37,"fingerprint":"javascript.lang.best-practice.lazy-load-module:packages/harness-studio/scripts/dev.mjs:37"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"packages/harness-studio/src/agent-react/linker/esbuild-host.ts","line":32,"fingerprint":"javascript.lang.best-practice.lazy-load-module:packages/harness-studio/src/agent-react/linker/esbuild-host.ts:32"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/App.tsx","line":1340,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/App.tsx:1340"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/app/CompareView.tsx","line":59,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/app/CompareView.tsx:59"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"packages/harness-studio/src/app/CustomizationView.tsx","line":41,"fingerprint":"typescript.react.best-practice.react-props-in-state:packages/harness-studio/src/app/CustomizationView.tsx:41"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/CustomizationView.tsx","line":256,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/CustomizationView.tsx:256"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"packages/harness-studio/src/app/GitHistoryView.tsx","line":520,"fingerprint":"typescript.react.best-practice.react-props-in-state:packages/harness-studio/src/app/GitHistoryView.tsx:520"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/artifacts/AgentReactPreviewHost.tsx","line":349,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/artifacts/AgentReactPreviewHost.tsx:349"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/artifacts/AgentReactPreviewHost.tsx","line":350,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/artifacts/AgentReactPreviewHost.tsx:350"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/artifacts/AgentReactPreviewHost.tsx","line":351,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/artifacts/AgentReactPreviewHost.tsx:351"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/artifacts/ArtifactPreviewHost.tsx","line":165,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/artifacts/ArtifactPreviewHost.tsx:165"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/artifacts/ArtifactPreviewHost.tsx","line":166,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/artifacts/ArtifactPreviewHost.tsx:166"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/artifacts/ArtifactPreviewHost.tsx","line":167,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/artifacts/ArtifactPreviewHost.tsx:167"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/app/code/code-rendering-model.ts","line":119,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/app/code/code-rendering-model.ts:119"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx","line":12,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx:12"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx","line":16,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx:16"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx","line":22,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx:22"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx","line":32,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/chain-of-thought.tsx:32"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/confirmation.tsx","line":17,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/confirmation.tsx:17"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/confirmation.tsx","line":19,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/confirmation.tsx:19"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/confirmation.tsx","line":21,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/confirmation.tsx:21"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/confirmation.tsx","line":22,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/confirmation.tsx:22"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/conversation.tsx","line":9,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/conversation.tsx:9"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/conversation.tsx","line":13,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/conversation.tsx:13"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/conversation.tsx","line":17,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/conversation.tsx:17"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/conversation.tsx","line":22,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/conversation.tsx:22"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/message.tsx","line":11,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/message.tsx:11"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/message.tsx","line":15,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/message.tsx:15"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/message.tsx","line":21,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/message.tsx:21"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx","line":12,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx:12"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx","line":13,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx:13"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx","line":14,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx:14"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx","line":15,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx:15"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx","line":16,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx:16"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx","line":20,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx:20"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx","line":112,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/prompt-input.tsx:112"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/suggestion.tsx","line":5,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/suggestion.tsx:5"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/suggestion.tsx","line":9,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/suggestion.tsx:9"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/tool.tsx","line":16,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/tool.tsx:16"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/tool.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/tool.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/tool.tsx","line":37,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/tool.tsx:37"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/tool.tsx","line":42,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/tool.tsx:42"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/components/ai-elements/tool.tsx","line":45,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/components/ai-elements/tool.tsx:45"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"packages/harness-studio/src/app/experiment/ExperimentView.tsx","line":44,"fingerprint":"typescript.react.best-practice.react-props-in-state:packages/harness-studio/src/app/experiment/ExperimentView.tsx:44"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/app/experiment/ExperimentView.tsx","line":241,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/app/experiment/ExperimentView.tsx:241"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/experiment/ExperimentWorkbench.tsx","line":164,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/experiment/ExperimentWorkbench.tsx:164"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/experiment/ExperimentWorkbench.tsx","line":164,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/experiment/ExperimentWorkbench.tsx:164"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/experiment/ExperimentWorkbench.tsx","line":226,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/experiment/ExperimentWorkbench.tsx:226"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/app/experiment/experiment-trace-model.ts","line":363,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/app/experiment/experiment-trace-model.ts:363"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/app/experiment/experiment-trace-model.ts","line":364,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/app/experiment/experiment-trace-model.ts:364"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/app/experiment/experiment-trace-model.ts","line":412,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/app/experiment/experiment-trace-model.ts:412"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/memory-review/MemoryWorkbench.tsx","line":54,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/memory-review/MemoryWorkbench.tsx:54"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/memory-review/MemoryWorkbench.tsx","line":55,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/memory-review/MemoryWorkbench.tsx:55"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/memory-review/MemoryWorkbench.tsx","line":56,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/memory-review/MemoryWorkbench.tsx:56"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/native-chart/NativeChartSurface.tsx","line":29,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/native-chart/NativeChartSurface.tsx:29"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/performance/SessionPerformanceWorkspace.tsx","line":184,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/performance/SessionPerformanceWorkspace.tsx:184"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/performance/SessionTranscriptPane.tsx","line":48,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/performance/SessionTranscriptPane.tsx:48"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/performance/StorageReport.tsx","line":64,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/performance/StorageReport.tsx:64"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/performance/StorageReport.tsx","line":65,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/performance/StorageReport.tsx:65"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/performance/StorageReport.tsx","line":73,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/performance/StorageReport.tsx:73"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/run/RunView.tsx","line":525,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/run/RunView.tsx:525"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/run/RunView.tsx","line":525,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/run/RunView.tsx:525"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/run/RunView.tsx","line":525,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/run/RunView.tsx:525"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/run/RunView.tsx","line":525,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/run/RunView.tsx:525"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/run/RunView.tsx","line":553,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/run/RunView.tsx:553"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/run/RunView.tsx","line":602,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/run/RunView.tsx:602"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/harness-studio/src/app/run/RunView.tsx","line":602,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/harness-studio/src/app/run/RunView.tsx:602"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"packages/harness-studio/src/app/run/use-streaming-text.ts","line":20,"fingerprint":"typescript.react.best-practice.react-props-in-state:packages/harness-studio/src/app/run/use-streaming-text.ts:20"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"packages/harness-studio/src/app/shell/DataTable.tsx","line":76,"fingerprint":"typescript.react.best-practice.react-props-in-state:packages/harness-studio/src/app/shell/DataTable.tsx:76"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/contracts/markdown-parser.ts","line":58,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/contracts/markdown-parser.ts:58"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/contracts/markdown-parser.ts","line":58,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/contracts/markdown-parser.ts:58"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/adapters/pptx-artifact-adapter.ts","line":404,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/adapters/pptx-artifact-adapter.ts:404"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts","line":281,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts:281"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts","line":607,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts:607"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts","line":607,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/registry/artifact-compile-runtime.ts:607"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/registry/artifact-plugin-registry.ts","line":436,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/registry/artifact-plugin-registry.ts:436"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/registry/artifact-plugin-registry.ts","line":443,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/registry/artifact-plugin-registry.ts:443"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/registry/artifact-provider-activation.ts","line":256,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/registry/artifact-provider-activation.ts:256"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/registry/artifact-viewers.ts","line":127,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/registry/artifact-viewers.ts:127"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/artifacts/routes.ts","line":156,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/artifacts/routes.ts:156"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":87,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":87,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":87,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":88,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:88"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":90,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:90"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":90,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:90"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":90,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:90"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":90,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:90"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts","line":90,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/providers/qoder/canvas-viewer-bridge.ts:90"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/workspace/routes.ts","line":105,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/workspace/routes.ts:105"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/workspace/routes.ts","line":653,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/workspace/routes.ts:653"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness-studio/src/server/workspace/routes.ts","line":727,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness-studio/src/server/workspace/routes.ts:727"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/compare/permissions.ts","line":95,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/compare/permissions.ts:95"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/compare/runner.ts","line":665,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/compare/runner.ts:665"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/compare/runner.ts","line":665,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/compare/runner.ts:665"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/compare/runner.ts","line":665,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/compare/runner.ts:665"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/compare/runner.ts","line":665,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/compare/runner.ts:665"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/compare/runner.ts","line":673,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/compare/runner.ts:673"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/exec/skill-delivery.ts","line":184,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/exec/skill-delivery.ts:184"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/experiment/runner.ts","line":102,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/experiment/runner.ts:102"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/experiment/runner.ts","line":540,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/experiment/runner.ts:540"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/experiment/runner.ts","line":541,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/experiment/runner.ts:541"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/harness/src/resolver/source-lock.ts","line":184,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/harness/src/resolver/source-lock.ts:184"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/agent-customize/providers/dsh.mjs","line":529,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/agent-customize/providers/dsh.mjs:529"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/agent-guardrails/secret-scan.mjs","line":583,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/agent-guardrails/secret-scan.mjs:583"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/ai-contribution-census/cli.mjs","line":176,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/ai-contribution-census/cli.mjs:176"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/ai-contribution-census/cli.mjs","line":580,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/ai-contribution-census/cli.mjs:580"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/coding-agent-practices/asset-baseline.mjs","line":217,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/coding-agent-practices/asset-baseline.mjs:217"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/commit-session-link/cli.mjs","line":120,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/commit-session-link/cli.mjs:120"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/render-html.mjs","line":20,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/render-html.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/render-html.mjs","line":20,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/render-html.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/render-html.mjs","line":20,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/render-html.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/render-html.mjs","line":20,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/render-html.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/render-html.mjs","line":20,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/render-html.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/session-source.mjs","line":66,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/session-source.mjs:66"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/tool-activity.mjs","line":81,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/tool-activity.mjs:81"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/commit-session-link/tool-attribution.mjs","line":8,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/commit-session-link/tool-attribution.mjs:8"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/core-change-watch/common.mjs","line":152,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/core-change-watch/common.mjs:152"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/core-change-watch/git-history-profile.mjs","line":200,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/core-change-watch/git-history-profile.mjs:200"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/dependency-governance/cli.mjs","line":103,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/dependency-governance/cli.mjs:103"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/dependency-governance/cli.mjs","line":225,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/dependency-governance/cli.mjs:225"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/doc-link-graph/cli.mjs","line":117,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/doc-link-graph/cli.mjs:117"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/harness-analysis/canvas-preview/server.mjs","line":122,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/harness-analysis/canvas-preview/server.mjs:122"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/evidence-brief.mjs","line":24,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/evidence-brief.mjs:24"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/evidence-brief.mjs","line":24,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/evidence-brief.mjs:24"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/learning-capture-evidence.mjs","line":70,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/learning-capture-evidence.mjs:70"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/repair-findings-json.mjs","line":87,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/repair-findings-json.mjs:87"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/repair-findings-json.mjs","line":398,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/repair-findings-json.mjs:398"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/report-source/source.mjs","line":232,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/report-source/source.mjs:232"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/report-source/source.mjs","line":322,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/report-source/source.mjs:322"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/task-loop-report.mjs","line":3027,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/task-loop-report.mjs:3027"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/task-loop-report.mjs","line":3037,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/task-loop-report.mjs:3037"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/task-loop-repository-evidence.mjs","line":15,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/task-loop-repository-evidence.mjs:15"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/task-loop-source.mjs","line":263,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/task-loop-source.mjs:263"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/task-loop-source.mjs","line":342,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/task-loop-source.mjs:342"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/task-loop-source.mjs","line":676,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/task-loop-source.mjs:676"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/task-loop-source.mjs","line":679,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/task-loop-source.mjs:679"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/validate-canvas.mjs","line":944,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/validate-canvas.mjs:944"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/workflow-demand-diagnostics.mjs","line":306,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/workflow-demand-diagnostics.mjs:306"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/workflow-demand-diagnostics.mjs","line":310,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/workflow-demand-diagnostics.mjs:310"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/workflow-demand-diagnostics.mjs","line":318,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/workflow-demand-diagnostics.mjs:318"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/workflow-demand-diagnostics.mjs","line":340,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/workflow-demand-diagnostics.mjs:340"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-analysis/workflow-demand-diagnostics.mjs","line":948,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-analysis/workflow-demand-diagnostics.mjs:948"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/harness-analysis/workflow-demand-diagnostics.mjs","line":1340,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/harness-analysis/workflow-demand-diagnostics.mjs:1340"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/harness-analysis/workflow-demand-diagnostics.mjs","line":1340,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/harness-analysis/workflow-demand-diagnostics.mjs:1340"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-component-snapshot/contract.mjs","line":77,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-component-snapshot/contract.mjs:77"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-component-snapshot/snapshot.mjs","line":51,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-component-snapshot/snapshot.mjs:51"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-component-snapshot/snapshot.mjs","line":302,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-component-snapshot/snapshot.mjs:302"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":37,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:37"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":37,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:37"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":37,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:37"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":37,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:37"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":37,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:37"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":46,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:46"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":46,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:46"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/render-html.mjs","line":46,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/render-html.mjs:46"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/report-model.mjs","line":49,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/report-model.mjs:49"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/ui/workbench.js","line":60,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/ui/workbench.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/ui/workbench.js","line":60,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/ui/workbench.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/ui/workbench.js","line":60,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/ui/workbench.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/ui/workbench.js","line":60,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/ui/workbench.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/ui/workbench.js","line":60,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/ui/workbench.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/harness-inspector/ui/workbench.js","line":80,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/harness-inspector/ui/workbench.js:80"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/memory/cli.mjs","line":14,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/memory/cli.mjs:14"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/npm-package/verify-pack.mjs","line":120,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/npm-package/verify-pack.mjs:120"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/plugin-lifecycle/human-output.mjs","line":2,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/plugin-lifecycle/human-output.mjs:2"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/plugin-lifecycle/human-output.mjs","line":2,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/plugin-lifecycle/human-output.mjs:2"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/plugin-lifecycle/human-output.mjs","line":2,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/plugin-lifecycle/human-output.mjs:2"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/plugin-lifecycle/human-output.mjs","line":2,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/plugin-lifecycle/human-output.mjs:2"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/plugin-lifecycle/plan-model.mjs","line":202,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/plugin-lifecycle/plan-model.mjs:202"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/plugin-lifecycle/plan-model.mjs","line":202,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/plugin-lifecycle/plan-model.mjs:202"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/review-trigger/cli.mjs","line":162,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/review-trigger/cli.mjs:162"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/session-analysis/episode-contract.mjs","line":122,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/session-analysis/episode-contract.mjs:122"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/session-analysis/episode-contract.mjs","line":122,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/session-analysis/episode-contract.mjs:122"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/task-evidence-upload/contract.mjs","line":183,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/task-evidence-upload/contract.mjs:183"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/task-evidence-upload/contract.mjs","line":184,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/task-evidence-upload/contract.mjs:184"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/workspace-topology/contract.mjs","line":44,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/workspace-topology/contract.mjs:44"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/workspace-topology/manifests.mjs","line":26,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/workspace-topology/manifests.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":".agents/skills/triangulate-spec-review/scripts/run-triad-review.mjs","line":56,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:.agents/skills/triangulate-spec-review/scripts/run-triad-review.mjs:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"dev/html-preview.mjs","line":23,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:dev/html-preview.mjs:23"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"dev/html-preview.mjs","line":23,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:dev/html-preview.mjs:23"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/git-scripts/blast-radius/git.mjs","line":74,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/git-scripts/blast-radius/git.mjs:74"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/git-scripts/blast-radius/git.mjs","line":74,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/git-scripts/blast-radius/git.mjs:74"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/git-scripts/blast-radius/hook.mjs","line":26,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/git-scripts/blast-radius/hook.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/git-scripts/blast-radius/hook.mjs","line":26,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/git-scripts/blast-radius/hook.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/git-scripts/blast-radius/hook.mjs","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/git-scripts/blast-radius/hook.mjs:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/git-scripts/blast-radius/hook.mjs","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/git-scripts/blast-radius/hook.mjs:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"hooks/git-scripts/blast-radius/hook.mjs","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:hooks/git-scripts/blast-radius/hook.mjs:94"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.9363,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":106032.0,"source_lines":226503.0,"test_ratio":0.4681,"ci_files":5.0,"cochange_share":0.8465,"cochange_commits":228.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/better-harness-desktop.yml","ref":".github/workflows/better-harness-desktop.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/pages.yml","ref":".github/workflows/pages.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/studio-desktop-release.yml","ref":".github/workflows/studio-desktop-release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm run test, vitest)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm run test","vitest"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":353.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":24.0,"escapes_per_kloc":0.321},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: packages/harness-studio/tsconfig.json","ref":"packages/harness-studio/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":87115.0,"other_lines":139388.0,"files_blamed":943.0,"blame_failures":0.0,"quality:ai_findings":113.0,"quality:ai_per_kloc":1.297,"quality:other_findings":87.0,"quality:other_per_kloc":0.624,"quality:ratio":2.08,"security:ai_findings":113.0,"security:ai_per_kloc":1.297,"security:other_findings":186.0,"security:other_per_kloc":1.334,"security:ratio":0.97},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":["phantom-dependency"]}