{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:02.016026Z","repo":{"ref":{"host":"github.com","owner":"TreeFallSound","name":"pistomp-recovery"},"default_branch":"main","clone_url":"https://github.com/TreeFallSound/pistomp-recovery.git","html_url":"https://github.com/TreeFallSound/pistomp-recovery","description":"Package update and recovery service for pi-Stomp.","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1505,"primary_language":"Python","license_spdx":null,"created_at":"2026-06-09T04:45:00Z","pushed_at":"2026-09-25T03:56:58Z","security_policy_url":null,"distribution":{"owner_created_at":"2020-02-15T03:50:25Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"e53bbce45ea1c134207887b05d1a30b98de00a5c","profile":{"lines_by_language":{"Python":12159,"Shell":31},"files_by_category":{"binary":58,"source":54,"test":21,"docs":5,"config":2,"generated":1},"source_lines":7493,"test_lines":4697},"pillars":{"ai_provenance":{"score":1.0,"confidence":0.59,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0098,"suspected_share":0.1288,"estimated_share":0.0098,"ai_artifacts":1.0,"flagged_work_units":2.0,"flagged_releases":null,"style_index":0.0},"summary":"Weak signals consistent with AI-assisted development. 2 commit(s) carry explicit AI attribution, too few to characterize the codebase."},"quality":{"score":62.2,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":87.1,"duplication":76.6,"lint":42.0,"testing":55.0,"docs":40.0,"type_safety":60.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.63, no CI test run detected; 5% of function code in complex or long functions; 4% duplicated lines. Weakest area: docs."},"security":{"score":78.2,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":94.3,"dependencies":74.1,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 58 known vulnerabilities in 2 dependencies; 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":14.0,"checked":14.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":78.0,"attributed_commits":2.0,"attributed_commit_share":0.02564102564102564,"effective_loc":20986.0,"attributed_loc":206.0,"attributed_loc_share":0.009816067854760316,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 2 attributed commits, 206 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e53bbce45ea1c134207887b05d1a30b98de00a5c","url":"https://github.com/TreeFallSound/pistomp-recovery/commit/e53bbce45ea1c134207887b05d1a30b98de00a5c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"22d26df84717113fa66fa175ced4b27382d17b2b","url":"https://github.com/TreeFallSound/pistomp-recovery/commit/22d26df84717113fa66fa175ced4b27382d17b2b","weight":0.9}],"data":{"attributed_loc_by_commit":{"22d26df84717113fa66fa175ced4b27382d17b2b":121,"e53bbce45ea1c134207887b05d1a30b98de00a5c":85},"tools":{"claude-code":{"name":"Claude Code","commits":2,"loc":206,"first_seen":1784687912,"last_seen":1790308616}},"monthly":{"2026-06":{"loc":17036,"attributed_loc":0},"2026-07":{"loc":2275,"attributed_loc":121},"2026-08":{"loc":315,"attributed_loc":0},"2026-09":{"loc":1360,"attributed_loc":85}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1780978759.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1780978759}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":45.0,"flagged_units":2.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":15263.0,"flagged_loc":2703.0,"flagged_loc_share":0.17709493546484964,"max_loc_per_hour":1400.528973310892,"median_loc_per_hour":110.6037515192956,"pr_timed_units":0.0,"excluded_import_loc":5723.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,618 lines of first-party code in ~1.2h (1,401 lines/hour, 1 commit session)","ref":"8d9fefbaf77d8e93ca743f412d57e18a3bec1cd4","url":"https://github.com/TreeFallSound/pistomp-recovery/commit/8d9fefbaf77d8e93ca743f412d57e18a3bec1cd4","weight":0.4201586919932676},{"kind":"velocity-burst","description":"1,085 lines of first-party code in ~0.9h (1,189 lines/hour, 1 commit session)","ref":"ae003235184e80bab9ba7007831f2ce50648c6c3","url":"https://github.com/TreeFallSound/pistomp-recovery/commit/ae003235184e80bab9ba7007831f2ce50648c6c3","weight":0.35682095006090137}],"data":{"flagged_loc_by_commit":{"ae003235184e80bab9ba7007831f2ce50648c6c3":1085,"8d9fefbaf77d8e93ca743f412d57e18a3bec1cd4":1618},"excluded_import_commits":["392bae04bc281d096496f2e0b82652daf08ca780","51a72f0410d87a38d8201912a3265a8e316f92b8"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7493.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":3.0,"findings_high":1.0,"findings_medium":2.0,"findings_low":0.0,"weighted_findings":1.25,"scanned_lines":7493.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/pistomp_recovery/git_util.py","line":18,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/pistomp_recovery/git_util.py:18"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"src/pistomp_recovery/plugins.py","line":302,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:src/pistomp_recovery/plugins.py:302"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"src/pistomp_recovery/plugins.py","line":322,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:src/pistomp_recovery/plugins.py:322"}],"evidence":[],"data":{"rulesets":["python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":2.0,"vulnerabilities":58.0,"vulns_critical":6.0,"vulns_high":37.0,"vulns_medium":13.0,"vulns_low":1.0,"vulns_unknown":1.0,"penalty":18.0},"findings":[{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-v9pv-5gc8-w2m6","severity":"critical","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-v9pv-5gc8-w2m6"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@12.2.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@12.2.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-pg7v-jwj7-p798","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3452, GHSA-pg7v-jwj7-p798","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-pg7v-jwj7-p798"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-4rr5-89j8-mwwm","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4328, GHSA-4rr5-89j8-mwwm","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-4rr5-89j8-mwwm"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-cp9v-662q-vvx9","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4333, GHSA-cp9v-662q-vvx9","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-cp9v-662q-vvx9"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-g4qv-2jxx-769h","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4342, GHSA-g4qv-2jxx-769h","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-g4qv-2jxx-769h"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-78g4-xqwv-q3g8","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-78g4-xqwv-q3g8","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-78g4-xqwv-q3g8"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@12.2.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-654x-cwwv-5j9c","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4336, GHSA-654x-cwwv-5j9c","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-654x-cwwv-5j9c"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@12.2.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"uv.lock","line":null,"fingerprint":"pillow@12.2.0 (PyPI):GHSA-wqgw-9xfh-qf2g"},{"rule_id":"osv/GHSA-h35f-9h28-mq5c","severity":"medium","message":"setuptools@82.0.1 (PyPI) is affected by PYSEC-2026-3447, GHSA-h35f-9h28-mq5c","path":"uv.lock","line":null,"fingerprint":"setuptools@82.0.1 (PyPI):GHSA-h35f-9h28-mq5c"},{"rule_id":"osv/GHSA-xmj3-9gf7-h52w","severity":"low","message":"setuptools@82.0.1 (PyPI) is affected by GHSA-xmj3-9gf7-h52w","path":"uv.lock","line":null,"fingerprint":"setuptools@82.0.1 (PyPI):GHSA-xmj3-9gf7-h52w"}],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0128,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":511.0,"function_nloc":4591.0,"mean_ccn":2.72,"p90_ccn":6.0,"complex_functions":4.0,"long_functions":0.0,"many_param_functions":2.0,"risky_nloc_share":0.0462},"findings":[],"evidence":[{"kind":"complex-function","description":"_build_domain_rows in src/pistomp_recovery/app.py: complexity 20, 59 lines","ref":"src/pistomp_recovery/app.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/app.py#L466","weight":0.3333333333333333},{"kind":"complex-function","description":"list_items in src/pistomp_recovery/pedalboards.py: complexity 18, 68 lines","ref":"src/pistomp_recovery/pedalboards.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/pedalboards.py#L42","weight":0.3},{"kind":"complex-function","description":"handle_event in src/pistomp_recovery/ui/screens/menu_screen.py: complexity 18, 54 lines","ref":"src/pistomp_recovery/ui/screens/menu_screen.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/ui/screens/menu_screen.py#L201","weight":0.3},{"kind":"complex-function","description":"domain_items in src/pistomp_recovery/backends_real.py: complexity 17, 31 lines","ref":"src/pistomp_recovery/backends_real.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/backends_real.py#L237","weight":0.2833333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5512.0,"duplicated_lines":245.0,"duplicated_share":0.0444,"files":54.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/app.py:555 and src/pistomp_recovery/app.py:568","ref":"src/pistomp_recovery/app.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/app.py#L555","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/backends_real.py:21 and src/pistomp_recovery/emulator/backends.py:24","ref":"src/pistomp_recovery/backends_real.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/backends_real.py#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/emulator/backends.py:204 and src/pistomp_recovery/packages/packages.py:92","ref":"src/pistomp_recovery/emulator/backends.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/emulator/backends.py#L204","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/emulator/controls.py:54 and src/pistomp_recovery/ui/input.py:36","ref":"src/pistomp_recovery/emulator/controls.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/emulator/controls.py#L54","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/git_util.py:126 and src/pistomp_recovery/git_util.py:137","ref":"src/pistomp_recovery/git_util.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/git_util.py#L126","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/hardware/switch.py:63 and src/pistomp_recovery/hardware/switch.py:139","ref":"src/pistomp_recovery/hardware/switch.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/hardware/switch.py#L63","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/packages/manager.py:158 and src/pistomp_recovery/packages/manager.py:389","ref":"src/pistomp_recovery/packages/manager.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/packages/manager.py#L158","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/ui/screens/crash.py:136 and src/pistomp_recovery/ui/screens/menu_screen.py:227","ref":"src/pistomp_recovery/ui/screens/crash.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/ui/screens/crash.py#L136","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/ui/screens/log_view.py:71 and src/pistomp_recovery/ui/screens/menu_screen.py:404","ref":"src/pistomp_recovery/ui/screens/log_view.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/ui/screens/log_view.py#L71","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pistomp_recovery/ui/screens/menu_screen.py:238 and src/pistomp_recovery/ui/screens/menu_screen.py:248","ref":"src/pistomp_recovery/ui/screens/menu_screen.py","url":"https://github.com/TreeFallSound/pistomp-recovery/blob/e53bbce45ea1c134207887b05d1a30b98de00a5c/src/pistomp_recovery/ui/screens/menu_screen.py#L238","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"weighted_findings":26.0,"scanned_lines":7493.0,"category:best-practice":11.0,"category:maintainability":1.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/pistomp_recovery/app.py","line":171,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/pistomp_recovery/app.py:171"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/pistomp_recovery/emulator/backends.py","line":335,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/pistomp_recovery/emulator/backends.py:335"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/pistomp_recovery/emulator/backends.py","line":360,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/pistomp_recovery/emulator/backends.py:360"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/pistomp_recovery/emulator/backends.py","line":434,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/pistomp_recovery/emulator/backends.py:434"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/pistomp_recovery/emulator/backends.py","line":443,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/pistomp_recovery/emulator/backends.py:443"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/pistomp_recovery/hardware/encoder.py","line":69,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/pistomp_recovery/hardware/encoder.py:69"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/pistomp_recovery/hardware/lcd.py","line":168,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/pistomp_recovery/hardware/lcd.py:168"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/pistomp_recovery/hardware/lcd.py","line":25,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/pistomp_recovery/hardware/lcd.py:25"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"src/pistomp_recovery/hardware/lcd.py","line":82,"fingerprint":"python.lang.best-practice.logging-error-without-handling:src/pistomp_recovery/hardware/lcd.py:82"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_pressed\" a function or an attribute? If it is a function, you may have meant self._button.is_pressed() because self._button.is_pressed is always true.","path":"src/pistomp_recovery/hardware/switch.py","line":135,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/pistomp_recovery/hardware/switch.py:135"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/pistomp_recovery/hardware/version.py","line":22,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/pistomp_recovery/hardware/version.py:22"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/pistomp_recovery/hardware/version.py","line":33,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/pistomp_recovery/hardware/version.py:33"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":4697.0,"source_lines":7493.0,"test_ratio":0.6269,"ci_files":0.0,"cochange_share":0.662,"cochange_commits":71.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":54.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":70.0,"escapes_per_kloc":9.381},"findings":[],"evidence":[{"kind":"typing","description":"Python strict type checking: pyproject.toml","ref":"pyproject.toml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":118.0,"other_lines":7375.0,"files_blamed":54.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":12.0,"quality:other_per_kloc":1.627,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":3.0,"security:other_per_kloc":0.407},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}