{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:00:39.384254Z","repo":{"ref":{"host":"github.com","owner":"alchaincyf","name":"huashu-motion"},"default_branch":"main","clone_url":"https://github.com/alchaincyf/huashu-motion.git","html_url":"https://github.com/alchaincyf/huashu-motion","description":"让你的agent一键直出商业级产品宣传片：会作曲，能指着画面改。Commercial-grade launch films by your coding agent — point at the frame to change it.","stars":2693,"forks":272,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":43241,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-10-18T12:19:27Z","pushed_at":"2026-11-10T00:15:11Z","security_policy_url":null,"distribution":{"owner_created_at":"2023-03-13T04:44:42Z","owner_type":"User","release_assets":[{"name":"claude-duet-fan-film-en.mp4","size":9348923,"download_count":91,"release_tag":"v0.2.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.2.0/claude-duet-fan-film-en.mp4"},{"name":"deepseek-v4.1-flash-specimen.mp4","size":11704977,"download_count":84,"release_tag":"v0.2.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.2.0/deepseek-v4.1-flash-specimen.mp4"},{"name":"grok-bot-fan-film.mp4","size":27318323,"download_count":61,"release_tag":"v0.2.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.2.0/grok-bot-fan-film.mp4"},{"name":"huashu-design-launch.mp4","size":24218583,"download_count":67,"release_tag":"v0.2.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.2.0/huashu-design-launch.mp4"},{"name":"huashu-motion-launch.mp4","size":31128161,"download_count":156,"release_tag":"v0.2.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.2.0/huashu-motion-launch.mp4"},{"name":"deepseek-v4.1-flash-specimen.mp4","size":11704977,"download_count":149,"release_tag":"v0.1.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.1.0/deepseek-v4.1-flash-specimen.mp4"},{"name":"grok-bot-fan-film.mp4","size":27318323,"download_count":91,"release_tag":"v0.1.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.1.0/grok-bot-fan-film.mp4"},{"name":"huashu-design-launch.mp4","size":24218583,"download_count":89,"release_tag":"v0.1.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.1.0/huashu-design-launch.mp4"},{"name":"huashu-motion-launch.mp4","size":31128161,"download_count":189,"release_tag":"v0.1.0","url":"https://github.com/alchaincyf/huashu-motion/releases/download/v0.1.0/huashu-motion-launch.mp4"}]}},"commit_sha":"0272906902c33c796a81637545905ea7f2b81c5a","profile":{"lines_by_language":{"JavaScript":15103,"Python":53},"files_by_category":{"binary":64,"source":62,"docs":61,"vendored":40,"test":29,"other":22,"config":21,"oversized":18},"source_lines":12640,"test_lines":2516},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.74,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":60.9,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":38.0,"duplication":100.0,"lint":66.7,"testing":55.0,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.20, no CI test run detected; 32% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity."},"security":{"score":63.4,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":90.5,"sast":63.3,"dependencies":null,"ci_actions":60.9,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 4 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":17.0,"attributed_commits":17.0,"attributed_commit_share":1.0,"effective_loc":15189.0,"attributed_loc":15189.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 17 attributed commits, 15,189 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"0272906902c33c796a81637545905ea7f2b81c5a","url":"https://github.com/alchaincyf/huashu-motion/commit/0272906902c33c796a81637545905ea7f2b81c5a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ba273ab50c60d02ce2daeb97aa82f14aebe7f0a7","url":"https://github.com/alchaincyf/huashu-motion/commit/ba273ab50c60d02ce2daeb97aa82f14aebe7f0a7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"52467f99c602b76ba86d511d37acdfe93fa1e16e","url":"https://github.com/alchaincyf/huashu-motion/commit/52467f99c602b76ba86d511d37acdfe93fa1e16e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f4f45e713165b47b835af5cdddbd25c0ccb0fc49","url":"https://github.com/alchaincyf/huashu-motion/commit/f4f45e713165b47b835af5cdddbd25c0ccb0fc49","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ad35c427df0c3f38999bcc2598f32af58a152e8f","url":"https://github.com/alchaincyf/huashu-motion/commit/ad35c427df0c3f38999bcc2598f32af58a152e8f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"245abe5fbcbad3afd4d5528bd9faf7a5894f042b","url":"https://github.com/alchaincyf/huashu-motion/commit/245abe5fbcbad3afd4d5528bd9faf7a5894f042b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a8c4784289dcfa59a1b882fdcc640d91d1934ad7","url":"https://github.com/alchaincyf/huashu-motion/commit/a8c4784289dcfa59a1b882fdcc640d91d1934ad7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"42360539c10d35397b352461347c073a2966031b","url":"https://github.com/alchaincyf/huashu-motion/commit/42360539c10d35397b352461347c073a2966031b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f6ffba4a5096ff21d9dd743b0afc093db1850b6b","url":"https://github.com/alchaincyf/huashu-motion/commit/f6ffba4a5096ff21d9dd743b0afc093db1850b6b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b8e581101327bf979ba3e4f9872e57e593832d78","url":"https://github.com/alchaincyf/huashu-motion/commit/b8e581101327bf979ba3e4f9872e57e593832d78","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"32c62004fe450ebde93fb9d7f5aaa178dedf9064","url":"https://github.com/alchaincyf/huashu-motion/commit/32c62004fe450ebde93fb9d7f5aaa178dedf9064","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f3d365adde77ec4e5317c6beaee312a4ba23c816","url":"https://github.com/alchaincyf/huashu-motion/commit/f3d365adde77ec4e5317c6beaee312a4ba23c816","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"08b63ffced3b3dbc8a4ba6918e704f37673e3f9f","url":"https://github.com/alchaincyf/huashu-motion/commit/08b63ffced3b3dbc8a4ba6918e704f37673e3f9f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5f2608c2e12abcf518f74dde86093b19f7f88603","url":"https://github.com/alchaincyf/huashu-motion/commit/5f2608c2e12abcf518f74dde86093b19f7f88603","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9ca6cd53356aee7d35e6db452237f51fd201a22f","url":"https://github.com/alchaincyf/huashu-motion/commit/9ca6cd53356aee7d35e6db452237f51fd201a22f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3e927801e78b587878fb7dbb65d616326df00c21","url":"https://github.com/alchaincyf/huashu-motion/commit/3e927801e78b587878fb7dbb65d616326df00c21","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a83107088a6189006a683e1417143cabf82401de","url":"https://github.com/alchaincyf/huashu-motion/commit/a83107088a6189006a683e1417143cabf82401de","weight":0.9}],"data":{"attributed_loc_by_commit":{"a83107088a6189006a683e1417143cabf82401de":13553,"3e927801e78b587878fb7dbb65d616326df00c21":0,"9ca6cd53356aee7d35e6db452237f51fd201a22f":26,"5f2608c2e12abcf518f74dde86093b19f7f88603":0,"08b63ffced3b3dbc8a4ba6918e704f37673e3f9f":317,"f3d365adde77ec4e5317c6beaee312a4ba23c816":24,"32c62004fe450ebde93fb9d7f5aaa178dedf9064":0,"b8e581101327bf979ba3e4f9872e57e593832d78":313,"f6ffba4a5096ff21d9dd743b0afc093db1850b6b":603,"42360539c10d35397b352461347c073a2966031b":0,"a8c4784289dcfa59a1b882fdcc640d91d1934ad7":30,"245abe5fbcbad3afd4d5528bd9faf7a5894f042b":174,"ad35c427df0c3f38999bcc2598f32af58a152e8f":0,"f4f45e713165b47b835af5cdddbd25c0ccb0fc49":0,"52467f99c602b76ba86d511d37acdfe93fa1e16e":0,"ba273ab50c60d02ce2daeb97aa82f14aebe7f0a7":149,"0272906902c33c796a81637545905ea7f2b81c5a":0},"tools":{"claude-code":{"name":"Claude Code","commits":17,"loc":15189,"first_seen":1792325958,"last_seen":1794269709}},"monthly":{"2026-10":{"loc":15040,"attributed_loc":15040},"2026-11":{"loc":149,"attributed_loc":149}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":5.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":1636.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":235.19750519750517,"median_loc_per_hour":73.14339093881364,"pr_timed_units":0.0,"excluded_import_loc":13553.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["a83107088a6189006a683e1417143cabf82401de"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":5.0,"flagged_releases":0.0,"max_loc_per_day":1529.3},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1.0","to":"v0.1.1","loc":26,"days":1.0,"loc_per_day":26.1,"flagged":false},{"from":"v0.1.1","to":"v0.2.0","loc":1257,"days":2.87,"loc_per_day":438.0,"flagged":false},{"from":"v0.2.0","to":"v0.3.0","loc":204,"days":0.13,"loc_per_day":1529.3,"flagged":false},{"from":"v0.3.0","to":"v0.3.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.3.1","to":"v0.4.0","loc":149,"days":18.47,"loc_per_day":8.1,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":12640.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":2.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"templates/blank/vendor/GSAP-LICENSE.html","line":1573,"fingerprint":"templates/blank/vendor/GSAP-LICENSE.html:generic-api-key:1573"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"examples/voice-demo/vendor/GSAP-LICENSE.html","line":1573,"fingerprint":"examples/voice-demo/vendor/GSAP-LICENSE.html:generic-api-key:1573"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"examples/showcase/vendor/GSAP-LICENSE.html","line":1573,"fingerprint":"examples/showcase/vendor/GSAP-LICENSE.html:generic-api-key:1573"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":58.0,"findings_high":4.0,"findings_medium":54.0,"findings_low":0.0,"weighted_findings":16.5,"scanned_lines":12640.0,"parse_errors":6.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":33,"fingerprint":"javascript.browser.security.insecure-document-method:studio/studio.js:33"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `t.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":33,"fingerprint":"javascript.browser.security.insecure-innerhtml:studio/studio.js:33"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":317,"fingerprint":"javascript.browser.security.insecure-document-method:studio/studio.js:317"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ctx.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":317,"fingerprint":"javascript.browser.security.insecure-innerhtml:studio/studio.js:317"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/capture.js","line":27,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/capture.js:27"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `n` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"cli/lib/capture.js","line":31,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:cli/lib/capture.js:31"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/export.js","line":38,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/export.js:38"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/export.js","line":133,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/export.js:133"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/export.js","line":139,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/export.js:139"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/export.js","line":251,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/export.js:251"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/export.js","line":269,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/export.js:269"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/fonts.js","line":33,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/fonts.js:33"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"cli/lib/fork.js","line":32,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:cli/lib/fork.js:32"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"cli/lib/inbox.js","line":26,"fingerprint":"javascript.lang.security.insecure-object-assign:cli/lib/inbox.js:26"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"cli/lib/inbox.js","line":27,"fingerprint":"javascript.lang.security.insecure-object-assign:cli/lib/inbox.js:27"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"cli/lib/inbox.js","line":28,"fingerprint":"javascript.lang.security.insecure-object-assign:cli/lib/inbox.js:28"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"cli/lib/inbox.js","line":29,"fingerprint":"javascript.lang.security.insecure-object-assign:cli/lib/inbox.js:29"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/learn.js","line":99,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/learn.js:99"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/project.js","line":16,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/project.js:16"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"cli/lib/project.js","line":228,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:cli/lib/project.js:228"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/qa.js","line":100,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/qa.js:100"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"cli/lib/score.js","line":142,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:cli/lib/score.js:142"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/server.js","line":117,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/server.js:117"},{"rule_id":"opengrep/javascript.lang.security.audit.unknown-value-with-script-tag","severity":"medium","message":"Cannot determine what 'csrf' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'csrf' is not externally controlled, or sanitize this data. [confidence low]","path":"cli/lib/server.js","line":117,"fingerprint":"javascript.lang.security.audit.unknown-value-with-script-tag:cli/lib/server.js:117"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/share.js","line":75,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/share.js:75"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/swatch.js","line":79,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/swatch.js:79"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/swatch.js","line":86,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/swatch.js:86"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/swatch.js","line":88,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/swatch.js:88"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/swatch.js","line":90,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/swatch.js:90"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/voice.js","line":436,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/voice.js:436"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/lib/voice.js","line":442,"fingerprint":"javascript.lang.security.html-in-template-string:cli/lib/voice.js:442"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `c` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"cli/om.js","line":88,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:cli/om.js:88"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"cli/om.js","line":177,"fingerprint":"javascript.lang.security.html-in-template-string:cli/om.js:177"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"runtime/camera-rig.js","line":13,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:runtime/camera-rig.js:13"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"runtime/clip/clip.js","line":98,"fingerprint":"javascript.lang.security.html-in-template-string:runtime/clip/clip.js:98"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"runtime/clip/grammars/t2_keynote_ui.js","line":33,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:runtime/clip/grammars/t2_keynote_ui.js:33"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"runtime/om-player.js","line":37,"fingerprint":"javascript.lang.security.html-in-template-string:runtime/om-player.js:37"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"runtime/om-player.js","line":38,"fingerprint":"javascript.lang.security.html-in-template-string:runtime/om-player.js:38"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"site/build.js","line":22,"fingerprint":"javascript.lang.security.html-in-template-string:site/build.js:22"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"site/build.js","line":84,"fingerprint":"javascript.lang.security.html-in-template-string:site/build.js:84"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"site/build.js","line":90,"fingerprint":"javascript.lang.security.html-in-template-string:site/build.js:90"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"site/build.js","line":98,"fingerprint":"javascript.lang.security.html-in-template-string:site/build.js:98"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"site/build.js","line":99,"fingerprint":"javascript.lang.security.html-in-template-string:site/build.js:99"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":263,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:263"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":288,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:288"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":293,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:293"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"studio/studio.js","line":317,"fingerprint":"javascript.lang.security.html-in-template-string:studio/studio.js:317"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":352,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:352"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":354,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:354"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":385,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:385"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":391,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:391"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":417,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:417"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":424,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:424"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":483,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:483"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":486,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:486"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"studio/studio.js","line":492,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:studio/studio.js:492"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"studio/studio.js","line":550,"fingerprint":"javascript.lang.security.html-in-template-string:studio/studio.js:550"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"studio/studio.js","line":551,"fingerprint":"javascript.lang.security.html-in-template-string:studio/studio.js:551"}],"evidence":[],"data":{"rulesets":["javascript","python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":5.0,"findings_high":3.0,"findings_medium":1.0,"findings_low":1.0,"penalty":29.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:26"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish.yml","line":26,"fingerprint":"cache-poisoning:.github/workflows/publish.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":23,"fingerprint":"artipacked:.github/workflows/publish.yml:23"},{"rule_id":"zizmor/adhoc-packages","severity":"low","message":"ad-hoc installation of packages [confidence high]","path":".github/workflows/publish.yml","line":36,"fingerprint":"adhoc-packages:.github/workflows/publish.yml:36"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"star-burst","description":"2693 stars in 26 days (102/day)","ref":null,"url":null,"weight":0.0}],"data":{"signals":["star-burst"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2319.0,"function_nloc":11542.0,"mean_ccn":3.68,"p90_ccn":8.0,"complex_functions":80.0,"long_functions":5.0,"many_param_functions":9.0,"risky_nloc_share":0.3225},"findings":[],"evidence":[{"kind":"complex-function","description":"main in cli/om.js: complexity 142, 225 lines","ref":"cli/om.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/cli/om.js#L105","weight":1.0},{"kind":"complex-function","description":"run in cli/lib/composer.js: complexity 105, 90 lines","ref":"cli/lib/composer.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/cli/lib/composer.js#L96","weight":1.0},{"kind":"complex-function","description":"(anonymous) in cli/lib/score.js: complexity 103, 85 lines","ref":"cli/lib/score.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/cli/lib/score.js#L458","weight":1.0},{"kind":"complex-function","description":"layout in runtime/clip/grammars/y3_whiteboard.js: complexity 98, 92 lines","ref":"runtime/clip/grammars/y3_whiteboard.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/runtime/clip/grammars/y3_whiteboard.js#L62","weight":1.0},{"kind":"complex-function","description":"draw in runtime/clip/grammars/t3_finance_chart.js: complexity 85, 109 lines","ref":"runtime/clip/grammars/t3_finance_chart.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/runtime/clip/grammars/t3_finance_chart.js#L74","weight":1.0},{"kind":"complex-function","description":"renderOm in cli/lib/render-om.js: complexity 76, 133 lines","ref":"cli/lib/render-om.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/cli/lib/render-om.js#L60","weight":1.0},{"kind":"complex-function","description":"C.mount in runtime/clip/clip.js: complexity 70, 62 lines","ref":"runtime/clip/clip.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/runtime/clip/clip.js#L110","weight":1.0},{"kind":"complex-function","description":"sound in cli/lib/sound.js: complexity 66, 81 lines","ref":"cli/lib/sound.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/cli/lib/sound.js#L480","weight":1.0},{"kind":"complex-function","description":"init in runtime/clip/grammars/t3_finance_chart.js: complexity 57, 42 lines","ref":"runtime/clip/grammars/t3_finance_chart.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/runtime/clip/grammars/t3_finance_chart.js#L29","weight":0.95},{"kind":"complex-function","description":"checkSource in cli/lib/check.js: complexity 51, 88 lines","ref":"cli/lib/check.js","url":"https://github.com/alchaincyf/huashu-motion/blob/0272906902c33c796a81637545905ea7f2b81c5a/cli/lib/check.js#L19","weight":0.85}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":10598.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":62.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":52.0,"weighted_findings":20.5,"scanned_lines":12640.0,"category:correctness":52.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"cli/lib/frames.js","line":58,"fingerprint":"javascript.lang.correctness.no-stringify-keys:cli/lib/frames.js:58"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"cli/lib/project.js","line":199,"fingerprint":"javascript.lang.correctness.no-stringify-keys:cli/lib/project.js:199"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"cli/lib/voice.js","line":453,"fingerprint":"javascript.lang.correctness.no-stringify-keys:cli/lib/voice.js:453"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"cli/lib/voice.js","line":460,"fingerprint":"javascript.lang.correctness.no-stringify-keys:cli/lib/voice.js:460"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"runtime/camera-rig.js","line":13,"fingerprint":"javascript.lang.correctness.no-stringify-keys:runtime/camera-rig.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"runtime/camera-rig.js","line":13,"fingerprint":"javascript.lang.correctness.no-stringify-keys:runtime/camera-rig.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"runtime/camera-rig.js","line":13,"fingerprint":"javascript.lang.correctness.no-stringify-keys:runtime/camera-rig.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"runtime/camera-rig.js","line":13,"fingerprint":"javascript.lang.correctness.no-stringify-keys:runtime/camera-rig.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"runtime/camera-rig.js","line":13,"fingerprint":"javascript.lang.correctness.no-stringify-keys:runtime/camera-rig.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"runtime/camera-rig.js","line":13,"fingerprint":"javascript.lang.correctness.no-stringify-keys:runtime/camera-rig.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":52,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:52"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":52,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:52"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/capture.js","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/capture.js:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/check.js","line":147,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/check.js:147"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/check.js","line":226,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/check.js:226"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/check.js","line":226,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/check.js:226"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/export.js","line":38,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/export.js:38"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/export.js","line":38,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/export.js:38"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/export.js","line":147,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/export.js:147"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/export.js","line":156,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/export.js:156"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/export.js","line":183,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/export.js:183"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/export.js","line":192,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/export.js:192"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/export.js","line":197,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/export.js:197"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/grab.js","line":57,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/grab.js:57"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/grab.js","line":57,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/grab.js:57"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/score.js","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/score.js:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/score.js","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/score.js:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/score.js","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/score.js:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/score.js","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/score.js:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/score.js","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/score.js:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/score.js","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/score.js:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/server.js","line":117,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/server.js:117"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/server.js","line":117,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/server.js:117"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/server.js","line":123,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/server.js:123"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/server.js","line":123,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/server.js:123"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/swatch.js","line":90,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/swatch.js:90"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/swatch.js","line":90,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/swatch.js:90"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/swatch.js","line":93,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/swatch.js:93"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/voice.js","line":603,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/voice.js:603"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"cli/lib/voice.js","line":603,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:cli/lib/voice.js:603"},{"rule_id":"opengrep/javascript.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected a useless comparison operation `x == x` or `x != x`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.","path":"cli/om.js","line":192,"fingerprint":"javascript.lang.correctness.eqeq-is-bad:cli/om.js:192"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"runtime/om-player.js","line":13,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:runtime/om-player.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"runtime/om-player.js","line":13,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:runtime/om-player.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"site/build.js","line":99,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:site/build.js:99"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"site/build.js","line":99,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:site/build.js:99"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"site/build.js","line":349,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:site/build.js:349"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.3981,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":2516.0,"source_lines":12640.0,"test_ratio":0.1991,"ci_files":1.0,"cochange_share":1.0,"cochange_commits":9.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/publish.yml","ref":".github/workflows/publish.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":278.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":12640.0,"other_lines":0.0,"files_blamed":62.0,"blame_failures":0.0,"quality:ai_findings":52.0,"quality:ai_per_kloc":4.114,"quality:other_findings":0.0,"security:ai_findings":58.0,"security:ai_per_kloc":4.589,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}