{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:20:52.777967Z","repo":{"ref":{"host":"github.com","owner":"TfTHacker","name":"timeline-for-bases"},"default_branch":"main","clone_url":"https://github.com/TfTHacker/timeline-for-bases.git","html_url":"https://github.com/TfTHacker/timeline-for-bases","description":"Timeline view for Bases in Obsidain","stars":89,"forks":2,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":7436,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-03-16T21:34:45Z","pushed_at":"2026-04-24T03:31:00Z","security_policy_url":null,"distribution":{"owner_created_at":"2020-08-02T18:51:48Z","owner_type":"User","release_assets":[{"name":"main.js","size":94807,"download_count":589,"release_tag":"0.1.11","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.11/main.js"},{"name":"manifest.json","size":353,"download_count":33419,"release_tag":"0.1.11","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.11/manifest.json"},{"name":"styles.css","size":33421,"download_count":579,"release_tag":"0.1.11","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.11/styles.css"},{"name":"main.js","size":100383,"download_count":94,"release_tag":"0.1.10","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.10/main.js"},{"name":"manifest.json","size":353,"download_count":508,"release_tag":"0.1.10","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.10/manifest.json"},{"name":"styles.css","size":33421,"download_count":94,"release_tag":"0.1.10","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.10/styles.css"},{"name":"main.js","size":97594,"download_count":23,"release_tag":"0.1.9","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.9/main.js"},{"name":"manifest.json","size":351,"download_count":34,"release_tag":"0.1.9","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.9/manifest.json"},{"name":"styles.css","size":33026,"download_count":23,"release_tag":"0.1.9","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.9/styles.css"},{"name":"main.js","size":287778,"download_count":23,"release_tag":"0.1.8","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.8/main.js"},{"name":"manifest.json","size":351,"download_count":40,"release_tag":"0.1.8","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.8/manifest.json"},{"name":"styles.css","size":33026,"download_count":23,"release_tag":"0.1.8","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.8/styles.css"},{"name":"main.js","size":285512,"download_count":52,"release_tag":"0.1.7","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.7/main.js"},{"name":"manifest.json","size":351,"download_count":117,"release_tag":"0.1.7","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.7/manifest.json"},{"name":"styles.css","size":32804,"download_count":51,"release_tag":"0.1.7","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.7/styles.css"},{"name":"main.js","size":285558,"download_count":119,"release_tag":"0.1.6","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.6/main.js"},{"name":"manifest.json","size":351,"download_count":1862,"release_tag":"0.1.6","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.6/manifest.json"},{"name":"styles.css","size":32804,"download_count":117,"release_tag":"0.1.6","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.6/styles.css"},{"name":"main.js","size":256406,"download_count":22,"release_tag":"0.1.5","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.5/main.js"},{"name":"manifest.json","size":351,"download_count":211,"release_tag":"0.1.5","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.5/manifest.json"},{"name":"styles.css","size":22802,"download_count":21,"release_tag":"0.1.5","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.5/styles.css"},{"name":"main.js","size":255721,"download_count":0,"release_tag":"0.1.4","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.4/main.js"},{"name":"manifest.json","size":351,"download_count":0,"release_tag":"0.1.4","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.4/manifest.json"},{"name":"styles.css","size":22802,"download_count":0,"release_tag":"0.1.4","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.4/styles.css"},{"name":"main.js","size":255171,"download_count":0,"release_tag":"0.1.3","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.3/main.js"},{"name":"manifest.json","size":350,"download_count":0,"release_tag":"0.1.3","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.3/manifest.json"},{"name":"styles.css","size":22676,"download_count":0,"release_tag":"0.1.3","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.3/styles.css"},{"name":"main.js","size":231414,"download_count":3,"release_tag":"0.1.2","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.2/main.js"},{"name":"manifest.json","size":290,"download_count":1,"release_tag":"0.1.2","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.2/manifest.json"},{"name":"styles.css","size":16968,"download_count":5,"release_tag":"0.1.2","url":"https://github.com/TfTHacker/timeline-for-bases/releases/download/0.1.2/styles.css"}]}},"commit_sha":"f72f35d787114201541048b665ebc1b22ce0f0aa","profile":{"lines_by_language":{"TypeScript":4463,"JavaScript":233,"Shell":31},"files_by_category":{"source":16,"config":10,"test":7,"docs":6,"oversized":1,"generated":1,"other":1},"source_lines":4315,"test_lines":412},"pillars":{"ai_provenance":{"score":0.8,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0082,"suspected_share":0.0,"estimated_share":0.0082,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase."},"quality":{"score":64.4,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":65.8,"duplication":84.4,"lint":56.0,"testing":40.8,"docs":85.0,"type_safety":100.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.10, no CI test run detected; 14% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing."},"security":{"score":66.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":80.0,"dependencies":55.8,"ci_actions":51.4,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 15 known vulnerabilities in 5 dependencies; 4 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":9.0,"checked":9.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":167.0,"attributed_commits":1.0,"attributed_commit_share":0.005988023952095809,"effective_loc":7802.0,"attributed_loc":64.0,"attributed_loc_share":0.008203024865419123,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 1 attributed commits, 64 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"28d69158b00b4940f0d1cd0c5b1d28cf05771b33","url":"https://github.com/TfTHacker/timeline-for-bases/commit/28d69158b00b4940f0d1cd0c5b1d28cf05771b33","weight":0.9}],"data":{"attributed_loc_by_commit":{"28d69158b00b4940f0d1cd0c5b1d28cf05771b33":64},"tools":{"claude-code":{"name":"Claude Code","commits":1,"loc":64,"first_seen":1773732456,"last_seen":1773732456}},"monthly":{"2026-03":{"loc":6330,"attributed_loc":64},"2026-04":{"loc":1472,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":25.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":7802.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":346.4030896118348,"median_loc_per_hour":126.96827922583324,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":10.0,"flagged_releases":0.0,"max_loc_per_day":1815.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.1.1","to":"0.1.2","loc":3,"days":0.04,"loc_per_day":72.0,"flagged":false},{"from":"0.1.2","to":"0.1.3","loc":2621,"days":1.44,"loc_per_day":1815.5,"flagged":false},{"from":"0.1.3","to":"0.1.4","loc":86,"days":0.2,"loc_per_day":425.4,"flagged":false},{"from":"0.1.4","to":"0.1.5","loc":34,"days":0.83,"loc_per_day":40.8,"flagged":false},{"from":"0.1.5","to":"0.1.6","loc":2124,"days":9.97,"loc_per_day":213.0,"flagged":false},{"from":"0.1.6","to":"0.1.7","loc":4,"days":18.88,"loc_per_day":0.2,"flagged":false},{"from":"0.1.7","to":"0.1.8","loc":422,"days":1.28,"loc_per_day":329.9,"flagged":false},{"from":"0.1.8","to":"0.1.9","loc":112,"days":0.74,"loc_per_day":151.8,"flagged":false},{"from":"0.1.9","to":"0.1.10","loc":305,"days":0.41,"loc_per_day":739.2,"flagged":false},{"from":"0.1.10","to":"0.1.11","loc":629,"days":4.47,"loc_per_day":140.6,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":4315.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":11.0,"findings_high":0.0,"findings_medium":11.0,"findings_low":0.0,"weighted_findings":2.75,"scanned_lines":4315.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dirPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/push-to-nexus.mjs","line":13,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/push-to-nexus.mjs:13"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/push-to-nexus.mjs","line":17,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/push-to-nexus.mjs:17"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/push-to-nexus.mjs","line":18,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/push-to-nexus.mjs:18"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/push-to-nexus.mjs","line":20,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/push-to-nexus.mjs:20"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/push-to-nexus.mjs","line":24,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/push-to-nexus.mjs:24"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/push-to-nexus.mjs","line":24,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/push-to-nexus.mjs:24"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `watchPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/watch.mjs","line":58,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/watch.mjs:58"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `watchPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/watch.mjs","line":59,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/watch.mjs:59"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `indent` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"src/timeline-base-yaml.ts","line":35,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/timeline-base-yaml.ts:35"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `indent` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"src/timeline-base-yaml.ts","line":60,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/timeline-base-yaml.ts:60"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"src/timeline-view.ts","line":611,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/timeline-view.ts:611"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":5.0,"vulnerabilities":15.0,"vulns_critical":0.0,"vulns_high":10.0,"vulns_medium":5.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":35.0},"findings":[{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.4.1 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"package-lock.json","line":null,"fingerprint":"flatted@3.4.1 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.1 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-4p3w-j4w9-5jqw","severity":"medium","message":"moment@2.29.4 (npm) is affected by GHSA-4p3w-j4w9-5jqw","path":"package-lock.json","line":null,"fingerprint":"moment@2.29.4 (npm):GHSA-4p3w-j4w9-5jqw"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":6.0,"findings_high":4.0,"findings_medium":0.0,"findings_low":2.0,"penalty":39.9},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/release.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/release.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":51,"fingerprint":"unpinned-uses:.github/workflows/release.yml:51"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":23,"fingerprint":"cache-poisoning:.github/workflows/release.yml:23"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":19,"fingerprint":"artipacked:.github/workflows/release.yml:19"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":51,"fingerprint":"superfluous-actions:.github/workflows/release.yml:51"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.018,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":330.0,"function_nloc":3381.0,"mean_ccn":3.36,"p90_ccn":8.0,"complex_functions":6.0,"long_functions":2.0,"many_param_functions":4.0,"risky_nloc_share":0.1396},"findings":[],"evidence":[{"kind":"complex-function","description":"renderRow in src/timeline-view.ts: complexity 48, 119 lines","ref":"src/timeline-view.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-view.ts#L2160","weight":0.8},{"kind":"complex-function","description":"renderTimeline in src/timeline-view.ts: complexity 26, 114 lines","ref":"src/timeline-view.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-view.ts#L915","weight":0.43333333333333335},{"kind":"complex-function","description":"renderContextHeader in src/timeline-view.ts: complexity 25, 85 lines","ref":"src/timeline-view.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-view.ts#L1348","weight":0.4166666666666667},{"kind":"complex-function","description":"renderGridLines in src/timeline-view.ts: complexity 19, 54 lines","ref":"src/timeline-view.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-view.ts#L1911","weight":0.31666666666666665},{"kind":"complex-function","description":"resolveEntryDatesFromCache in src/timeline-view.ts: complexity 19, 32 lines","ref":"src/timeline-view.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-view.ts#L1129","weight":0.31666666666666665},{"kind":"complex-function","description":"_onDragEnd in src/timeline-view.ts: complexity 19, 68 lines","ref":"src/timeline-view.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-view.ts#L3096","weight":0.31666666666666665}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":3248.0,"duplicated_lines":92.0,"duplicated_share":0.0283,"files":16.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/timeline-axis.ts:16 and src/timeline-axis.ts:65","ref":"src/timeline-axis.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-axis.ts#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/timeline-view.ts:944 and src/timeline-view.ts:1066","ref":"src/timeline-view.ts","url":"https://github.com/TfTHacker/timeline-for-bases/blob/f72f35d787114201541048b665ebc1b22ce0f0aa/src/timeline-view.ts#L944","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"weighted_findings":10.0,"scanned_lines":4315.0,"category:correctness":10.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":365,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:365"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":368,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:368"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":561,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:561"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":563,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:563"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":1230,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:1230"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":1574,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:1574"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":1582,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:1582"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":1733,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:1733"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":1740,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:1740"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/timeline-view.ts","line":2228,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/timeline-view.ts:2228"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.191,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.1071,"test_lines":412.0,"source_lines":4315.0,"test_ratio":0.0955,"ci_files":1.0,"cochange_share":0.0268,"cochange_commits":112.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":76.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":2.0,"escapes_per_kloc":0.494},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":34.0,"other_lines":4281.0,"files_blamed":16.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":10.0,"quality:other_per_kloc":2.336,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":11.0,"security:other_per_kloc":2.569},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}