{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:02.790830Z","repo":{"ref":{"host":"github.com","owner":"arimk","name":"vibefighter"},"default_branch":"main","clone_url":"https://github.com/arimk/vibefighter.git","html_url":"https://github.com/arimk/vibefighter","description":"A generative fighting game","stars":3,"forks":1,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":47871,"primary_language":"TypeScript","license_spdx":null,"created_at":"2025-04-08T20:39:34Z","pushed_at":"2025-11-30T21:54:32Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-11-01T13:37:47Z","owner_type":"User","release_assets":[]}},"commit_sha":"38b460606ac551dc0b94f038b379bb2de51e80b1","profile":{"lines_by_language":{"TypeScript":12210,"SQL":399,"JavaScript":78},"files_by_category":{"binary":40,"source":38,"oversized":19,"config":6,"other":2,"docs":1,"generated":1},"source_lines":12687,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.51,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0865,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":0.394},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":42.1,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":32.1,"duplication":57.9,"lint":91.7,"testing":0.0,"docs":40.0,"type_safety":100.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 38% of function code in complex or long functions; 9% duplicated lines. Weakest area: testing."},"security":{"score":57.6,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":88.8,"dependencies":2.4,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 119 known vulnerabilities in 29 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":30.0,"checked":30.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":45.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":17337.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2025-04":{"loc":13570,"attributed_loc":0},"2025-05":{"loc":3484,"attributed_loc":0},"2025-11":{"loc":283,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":32.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":15268.0,"flagged_loc":1500.0,"flagged_loc_share":0.09824469478648153,"max_loc_per_hour":608.9996616668546,"median_loc_per_hour":161.4009433962264,"pr_timed_units":0.0,"excluded_import_loc":2069.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,500 lines of first-party code in ~2.5h (609 lines/hour, 2 commit session)","ref":"77e38a0466f81b7a1166134e1b1882f3ea75ba9c","url":"https://github.com/arimk/vibefighter/commit/77e38a0466f81b7a1166134e1b1882f3ea75ba9c","weight":0.18269989850005638}],"data":{"flagged_loc_by_commit":{"0a8354835870a127be795a0487d54a50c2466568":1469,"77e38a0466f81b7a1166134e1b1882f3ea75ba9c":31},"excluded_import_commits":["4f6578d88f2498550c237242562c393694eeffda"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":12687.0,"index":0.394,"count:narrated_steps":3.0,"per_kloc:narrated_steps":0.236,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.079,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:assistant_voice","description":"assistant-style phrasing left in code: output_format: \"jpg\", // Using jpg as requested","ref":"src/app/api/generate-concepts/route.ts:73","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/generate-concepts/route.ts#L73","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Update the name in Supabase","ref":"src/app/api/update-character-name/route.ts:50","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/update-character-name/route.ts#L50","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Generate TTS and update Supabase with audio URL (non-blocking for response)","ref":"src/app/api/update-character-name/route.ts:73","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/update-character-name/route.ts#L73","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Now we know startIntroAnimation is true for this character","ref":"src/components/PlayerCharacter.tsx:1055","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/components/PlayerCharacter.tsx#L1055","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":49.0,"findings_high":0.0,"findings_medium":6.0,"findings_low":43.0,"weighted_findings":4.188,"scanned_lines":12288.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":54,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/app/api/create-special-power/route.ts:54"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `originalMimeType` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":57,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/app/api/create-special-power/route.ts:57"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `originalMimeType` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":75,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/app/api/create-special-power/route.ts:75"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":494,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/app/api/create-special-power/route.ts:494"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/app/api/music-files/route.ts","line":7,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/app/api/music-files/route.ts:7"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `directory` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/app/api/music-files/route.ts","line":9,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/app/api/music-files/route.ts:9"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":72,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/create-special-power/route.ts:72"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":77,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/create-special-power/route.ts:77"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":92,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/create-special-power/route.ts:92"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":494,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/create-special-power/route.ts:494"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/create-special-power/route.ts","line":497,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/create-special-power/route.ts:497"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/initiate-character/route.ts","line":207,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/initiate-character/route.ts:207"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/initiate-character/route.ts","line":219,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/initiate-character/route.ts:219"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/music-files/route.ts","line":18,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/music-files/route.ts:18"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/rig-character/route.ts","line":82,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/rig-character/route.ts:82"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/rig-character/route.ts","line":90,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/rig-character/route.ts:90"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":76,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:76"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":86,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:86"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":92,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:92"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":137,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:137"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":140,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:140"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":167,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:167"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":190,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:190"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":199,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:199"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":225,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:225"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/task-status/[taskId]/route.ts","line":229,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/task-status/[taskId]/route.ts:229"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/update-character-name/route.ts","line":59,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/update-character-name/route.ts:59"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/update-character-name/route.ts","line":116,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/update-character-name/route.ts:116"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/update-character-name/route.ts","line":123,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/update-character-name/route.ts:123"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/api/update-character-name/route.ts","line":131,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/api/update-character-name/route.ts:131"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/character/[characterId]/CharacterViewer.tsx","line":205,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/character/[characterId]/CharacterViewer.tsx:205"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/character/[characterId]/free/page.tsx","line":153,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/character/[characterId]/free/page.tsx:153"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/character/[characterId]/free/page.tsx","line":1604,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/character/[characterId]/free/page.tsx:1604"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/character/[characterId]/page.tsx","line":31,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/character/[characterId]/page.tsx:31"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/create/page.tsx","line":405,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/create/page.tsx:405"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/create/page.tsx","line":414,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/create/page.tsx:414"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/create/page.tsx","line":533,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/create/page.tsx:533"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/create/page.tsx","line":560,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/create/page.tsx:560"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/app/fight/page.tsx","line":97,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/app/fight/page.tsx:97"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/BattleScene.tsx","line":89,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/BattleScene.tsx:89"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/BattleScene.tsx","line":92,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/BattleScene.tsx:92"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/BattleScene.tsx","line":623,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/BattleScene.tsx:623"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/PlayerCharacter.tsx","line":360,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/PlayerCharacter.tsx:360"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/PlayerCharacter.tsx","line":362,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/PlayerCharacter.tsx:362"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/PlayerCharacter.tsx","line":863,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/PlayerCharacter.tsx:863"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/PlayerCharacter.tsx","line":912,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/PlayerCharacter.tsx:912"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/components/PlayerCharacter.tsx","line":920,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/components/PlayerCharacter.tsx:920"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/utils/playSoundEffect.ts","line":17,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/utils/playSoundEffect.ts:17"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/utils/playSoundEffect.ts","line":20,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/utils/playSoundEffect.ts:20"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":29.0,"vulnerabilities":119.0,"vulns_critical":7.0,"vulns_high":64.0,"vulns_medium":39.0,"vulns_low":9.0,"vulns_unknown":0.0,"penalty":224.0},"findings":[{"rule_id":"osv/GHSA-m7jm-9gc2-mpf2","severity":"critical","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-m7jm-9gc2-mpf2","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-m7jm-9gc2-mpf2"},{"rule_id":"osv/GHSA-fjxv-7rqg-78g4","severity":"critical","message":"form-data@4.0.2 (npm) is affected by GHSA-fjxv-7rqg-78g4","path":"package-lock.json","line":null,"fingerprint":"form-data@4.0.2 (npm):GHSA-fjxv-7rqg-78g4"},{"rule_id":"osv/GHSA-2464-fhr4-w9xw","severity":"critical","message":"next@15.2.4 (npm) is affected by GHSA-2464-fhr4-w9xw","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-2464-fhr4-w9xw"},{"rule_id":"osv/GHSA-2xp9-vwfh-vxw4","severity":"critical","message":"next@15.2.4 (npm) is affected by GHSA-2xp9-vwfh-vxw4","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-2xp9-vwfh-vxw4"},{"rule_id":"osv/GHSA-9qr9-h5gf-34mp","severity":"critical","message":"next@15.2.4 (npm) is affected by GHSA-9qr9-h5gf-34mp","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-9qr9-h5gf-34mp"},{"rule_id":"osv/GHSA-p293-qw3h-jr36","severity":"critical","message":"next@15.2.4 (npm) is affected by GHSA-p293-qw3h-jr36","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-p293-qw3h-jr36"},{"rule_id":"osv/GHSA-23hp-3jrh-7fpw","severity":"critical","message":"tar@7.4.3 (npm) is affected by GHSA-23hp-3jrh-7fpw","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-23hp-3jrh-7fpw"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-8gc5-j5rx-235r","severity":"high","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-8gc5-j5rx-235r","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-8gc5-j5rx-235r"},{"rule_id":"osv/GHSA-jmr7-xgp7-cmfj","severity":"high","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-jmr7-xgp7-cmfj","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-jmr7-xgp7-cmfj"},{"rule_id":"osv/GHSA-px8p-9vwx-vf98","severity":"high","message":"fflate@0.6.10 (npm) is affected by GHSA-px8p-9vwx-vf98","path":"package-lock.json","line":null,"fingerprint":"fflate@0.6.10 (npm):GHSA-px8p-9vwx-vf98"},{"rule_id":"osv/GHSA-px8p-9vwx-vf98","severity":"high","message":"fflate@0.8.2 (npm) is affected by GHSA-px8p-9vwx-vf98","path":"package-lock.json","line":null,"fingerprint":"fflate@0.8.2 (npm):GHSA-px8p-9vwx-vf98"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-25h7-pfq9-p65f","path":"package-lock.json","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"package-lock.json","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.2 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"package-lock.json","line":null,"fingerprint":"form-data@4.0.2 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-869p-cjfg-cm3x","severity":"high","message":"jws@4.0.0 (npm) is affected by GHSA-869p-cjfg-cm3x","path":"package-lock.json","line":null,"fingerprint":"jws@4.0.0 (npm):GHSA-869p-cjfg-cm3x"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-267c-6grr-h53f","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-267c-6grr-h53f","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-267c-6grr-h53f"},{"rule_id":"osv/GHSA-26hh-7cqf-hhc6","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-26hh-7cqf-hhc6","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-26hh-7cqf-hhc6"},{"rule_id":"osv/GHSA-36qx-fr4f-26g5","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-36qx-fr4f-26g5","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-36qx-fr4f-26g5"},{"rule_id":"osv/GHSA-89xv-2m56-2m9x","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-89xv-2m56-2m9x","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-89xv-2m56-2m9x"},{"rule_id":"osv/GHSA-8h8q-6873-q5fj","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-8h8q-6873-q5fj","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-8h8q-6873-q5fj"},{"rule_id":"osv/GHSA-c4j6-fc7j-m34r","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-c4j6-fc7j-m34r","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-c4j6-fc7j-m34r"},{"rule_id":"osv/GHSA-h25m-26qc-wcjf","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-h25m-26qc-wcjf","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-h25m-26qc-wcjf"},{"rule_id":"osv/GHSA-m99w-x7hq-7vfj","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-m99w-x7hq-7vfj","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-m99w-x7hq-7vfj"},{"rule_id":"osv/GHSA-mg66-mrh9-m8jx","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-mg66-mrh9-m8jx","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-mg66-mrh9-m8jx"},{"rule_id":"osv/GHSA-mwv6-3258-q52c","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-mwv6-3258-q52c","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-mwv6-3258-q52c"},{"rule_id":"osv/GHSA-p3m5-59mp-jv5r","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-p3m5-59mp-jv5r","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-p3m5-59mp-jv5r"},{"rule_id":"osv/GHSA-p9j2-gv94-2wf4","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-p9j2-gv94-2wf4","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-p9j2-gv94-2wf4"},{"rule_id":"osv/GHSA-q4gf-8mx6-v5v3","severity":"high","message":"next@15.2.4 (npm) is affected by GHSA-q4gf-8mx6-v5v3","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-q4gf-8mx6-v5v3"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.2 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.2 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-6g55-p6wh-862q","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.3 (npm) is affected by GHSA-6g55-p6wh-862q","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.3 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.33.5 (npm) is affected by GHSA-f88m-g3jw-g9cj","path":"package-lock.json","line":null,"fingerprint":"sharp@0.33.5 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.33.5 (npm) is affected by GHSA-rgj7-g3m4-5g8c","path":"package-lock.json","line":null,"fingerprint":"sharp@0.33.5 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.33.5 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"package-lock.json","line":null,"fingerprint":"sharp@0.33.5 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-34x7-hfp2-rc4v","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-34x7-hfp2-rc4v","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-34x7-hfp2-rc4v"},{"rule_id":"osv/GHSA-83g3-92jg-28cx","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-83g3-92jg-28cx","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-83g3-92jg-28cx"},{"rule_id":"osv/GHSA-8qq5-rm4j-mr97","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-8qq5-rm4j-mr97","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-8qq5-rm4j-mr97"},{"rule_id":"osv/GHSA-8x88-c5mf-7j5w","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-8x88-c5mf-7j5w","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-8x88-c5mf-7j5w"},{"rule_id":"osv/GHSA-9ppj-qmqm-q256","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-9ppj-qmqm-q256","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-9ppj-qmqm-q256"},{"rule_id":"osv/GHSA-qffp-2rhf-9h96","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-qffp-2rhf-9h96","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-qffp-2rhf-9h96"},{"rule_id":"osv/GHSA-r292-9mhp-454m","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-r292-9mhp-454m","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-r292-9mhp-454m"},{"rule_id":"osv/GHSA-r6q2-hw4h-h46w","severity":"high","message":"tar@7.4.3 (npm) is affected by GHSA-r6q2-hw4h-h46w","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-r6q2-hw4h-h46w"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@11.1.0 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"package-lock.json","line":null,"fingerprint":"uuid@11.1.0 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@9.0.1 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"package-lock.json","line":null,"fingerprint":"uuid@9.0.1 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.18.1 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"package-lock.json","line":null,"fingerprint":"ws@8.18.1 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.6 (npm) is affected by GHSA-p498-v437-472g","path":"package-lock.json","line":null,"fingerprint":"@humanfs/node@0.16.6 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"package-lock.json","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-2wm5-q62r-hmrv","severity":"medium","message":"colord@2.9.3 (npm) is affected by GHSA-2wm5-q62r-hmrv","path":"package-lock.json","line":null,"fingerprint":"colord@2.9.3 (npm):GHSA-2wm5-q62r-hmrv"},{"rule_id":"osv/GHSA-gh4j-gqv2-49f6","severity":"medium","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-gh4j-gqv2-49f6","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-gh4j-gqv2-49f6"},{"rule_id":"osv/GHSA-jp2q-39xq-3w4g","severity":"medium","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-jp2q-39xq-3w4g","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-jp2q-39xq-3w4g"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-mh29-5h37-fv8m","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-mh29-5h37-fv8m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-mh29-5h37-fv8m"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-3x4c-7xq6-9pq8","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-3x4c-7xq6-9pq8","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-3x4c-7xq6-9pq8"},{"rule_id":"osv/GHSA-4342-x723-ch2f","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-4342-x723-ch2f","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-4342-x723-ch2f"},{"rule_id":"osv/GHSA-4633-3j49-mh5q","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-4633-3j49-mh5q","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-4633-3j49-mh5q"},{"rule_id":"osv/GHSA-4c39-4ccg-62r3","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-4c39-4ccg-62r3","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-4c39-4ccg-62r3"},{"rule_id":"osv/GHSA-4jqv-mc3x-m676","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-4jqv-mc3x-m676","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-4jqv-mc3x-m676"},{"rule_id":"osv/GHSA-68g3-v927-f742","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-68g3-v927-f742","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-68g3-v927-f742"},{"rule_id":"osv/GHSA-955p-x3mx-jcvp","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-955p-x3mx-jcvp","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-955p-x3mx-jcvp"},{"rule_id":"osv/GHSA-9g9p-9gw9-jx7f","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-9g9p-9gw9-jx7f","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-9g9p-9gw9-jx7f"},{"rule_id":"osv/GHSA-ffhc-5mcf-pf4q","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-ffhc-5mcf-pf4q","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-ffhc-5mcf-pf4q"},{"rule_id":"osv/GHSA-g5qg-72qw-gw5v","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-g5qg-72qw-gw5v","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-g5qg-72qw-gw5v"},{"rule_id":"osv/GHSA-ggv3-7p47-pfv8","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-ggv3-7p47-pfv8","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-ggv3-7p47-pfv8"},{"rule_id":"osv/GHSA-gx5p-jg67-6x7h","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-gx5p-jg67-6x7h","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-gx5p-jg67-6x7h"},{"rule_id":"osv/GHSA-h64f-5h5j-jqjh","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-h64f-5h5j-jqjh","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-h64f-5h5j-jqjh"},{"rule_id":"osv/GHSA-mcj8-r9mp-w47p","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-mcj8-r9mp-w47p","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-mcj8-r9mp-w47p"},{"rule_id":"osv/GHSA-w37m-7fhw-fmv9","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-w37m-7fhw-fmv9","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-w37m-7fhw-fmv9"},{"rule_id":"osv/GHSA-wfc6-r584-vfw7","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-wfc6-r584-vfw7","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-wfc6-r584-vfw7"},{"rule_id":"osv/GHSA-xv57-4mr9-wg8v","severity":"medium","message":"next@15.2.4 (npm) is affected by GHSA-xv57-4mr9-wg8v","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-xv57-4mr9-wg8v"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.2 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.2 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.3 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.3 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-gvwx-54wh-qm9j","severity":"medium","message":"tar@7.4.3 (npm) is affected by GHSA-gvwx-54wh-qm9j","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-gvwx-54wh-qm9j"},{"rule_id":"osv/GHSA-vmf3-w455-68vh","severity":"medium","message":"tar@7.4.3 (npm) is affected by GHSA-vmf3-w455-68vh","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-vmf3-w455-68vh"},{"rule_id":"osv/GHSA-w8wr-v893-vjvp","severity":"medium","message":"tar@7.4.3 (npm) is affected by GHSA-w8wr-v893-vjvp","path":"package-lock.json","line":null,"fingerprint":"tar@7.4.3 (npm):GHSA-w8wr-v893-vjvp"},{"rule_id":"osv/GHSA-58qx-3vcg-4xpx","severity":"medium","message":"ws@8.18.1 (npm) is affected by GHSA-58qx-3vcg-4xpx","path":"package-lock.json","line":null,"fingerprint":"ws@8.18.1 (npm):GHSA-58qx-3vcg-4xpx"},{"rule_id":"osv/GHSA-xffm-g5w8-qvg7","severity":"low","message":"@eslint/plugin-kit@0.2.8 (npm) is affected by GHSA-xffm-g5w8-qvg7","path":"package-lock.json","line":null,"fingerprint":"@eslint/plugin-kit@0.2.8 (npm):GHSA-xffm-g5w8-qvg7"},{"rule_id":"osv/GHSA-6475-r3vj-m8vf","severity":"low","message":"@smithy/config-resolver@4.1.0 (npm) is affected by GHSA-6475-r3vj-m8vf","path":"package-lock.json","line":null,"fingerprint":"@smithy/config-resolver@4.1.0 (npm):GHSA-6475-r3vj-m8vf"},{"rule_id":"osv/GHSA-8r88-6cj9-9fh5","severity":"low","message":"@supabase/auth-js@2.69.1 (npm) is affected by GHSA-8r88-6cj9-9fh5","path":"package-lock.json","line":null,"fingerprint":"@supabase/auth-js@2.69.1 (npm):GHSA-8r88-6cj9-9fh5"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-474x-hrwr-fgx4","severity":"low","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-474x-hrwr-fgx4","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-474x-hrwr-fgx4"},{"rule_id":"osv/GHSA-fj3w-jwp8-x2g3","severity":"low","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-fj3w-jwp8-x2g3","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-fj3w-jwp8-x2g3"},{"rule_id":"osv/GHSA-3g8h-86w9-wvmq","severity":"low","message":"next@15.2.4 (npm) is affected by GHSA-3g8h-86w9-wvmq","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-3g8h-86w9-wvmq"},{"rule_id":"osv/GHSA-vfv6-92ff-j949","severity":"low","message":"next@15.2.4 (npm) is affected by GHSA-vfv6-92ff-j949","path":"package-lock.json","line":null,"fingerprint":"next@15.2.4 (npm):GHSA-vfv6-92ff-j949"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":461.0,"function_nloc":8718.0,"mean_ccn":4.98,"p90_ccn":10.0,"complex_functions":25.0,"long_functions":14.0,"many_param_functions":2.0,"risky_nloc_share":0.3788},"findings":[],"evidence":[{"kind":"complex-function","description":"(anonymous) in src/components/PlayerCharacter.tsx: complexity 114, 214 lines","ref":"src/components/PlayerCharacter.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/components/PlayerCharacter.tsx#L1270","weight":1.0},{"kind":"complex-function","description":"(anonymous) in src/components/BattleScene.tsx: complexity 69, 193 lines","ref":"src/components/BattleScene.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/components/BattleScene.tsx#L385","weight":1.0},{"kind":"complex-function","description":"(anonymous) in src/components/AIController.tsx: complexity 64, 154 lines","ref":"src/components/AIController.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/components/AIController.tsx#L82","weight":1.0},{"kind":"complex-function","description":"VsPage in src/app/vs/[characterId]/page.tsx: complexity 54, 223 lines","ref":"src/app/vs/[characterId]/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/vs/[characterId]/page.tsx#L38","weight":0.9},{"kind":"complex-function","description":"(anonymous) in src/app/character/[characterId]/free/page.tsx: complexity 53, 197 lines","ref":"src/app/character/[characterId]/free/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/character/[characterId]/free/page.tsx#L337","weight":0.8833333333333333},{"kind":"complex-function","description":"CharacterPoseEditor in src/app/character/[characterId]/free/page.tsx: complexity 51, 257 lines","ref":"src/app/character/[characterId]/free/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/character/[characterId]/free/page.tsx#L94","weight":0.85},{"kind":"complex-function","description":"CreateCharacter in src/app/create/page.tsx: complexity 49, 203 lines","ref":"src/app/create/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/create/page.tsx#L33","weight":0.8166666666666667},{"kind":"complex-function","description":"(anonymous) in src/app/create/page.tsx: complexity 40, 87 lines","ref":"src/app/create/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/create/page.tsx#L388","weight":0.6666666666666666},{"kind":"complex-function","description":"POST in src/app/api/generate-location/route.ts: complexity 37, 138 lines","ref":"src/app/api/generate-location/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/generate-location/route.ts#L69","weight":0.6166666666666667},{"kind":"complex-function","description":"onAnimationFinished in src/app/character/[characterId]/free/page.tsx: complexity 32, 82 lines","ref":"src/app/character/[characterId]/free/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/character/[characterId]/free/page.tsx#L586","weight":0.5333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":9539.0,"duplicated_lines":868.0,"duplicated_share":0.091,"files":38.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/api/create-special-power/route.ts:341 and src/app/api/create-special-power/route.ts:356","ref":"src/app/api/create-special-power/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/create-special-power/route.ts#L341","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/api/generate-concepts/route.ts:21 and src/app/api/generate-location/route.ts:47","ref":"src/app/api/generate-concepts/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/generate-concepts/route.ts#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/api/generate-location/route.ts:37 and src/app/api/initiate-character/route.ts:20","ref":"src/app/api/generate-location/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/generate-location/route.ts#L37","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/api/initiate-character/route.ts:19 and src/app/api/task-status/[taskId]/route.ts:26","ref":"src/app/api/initiate-character/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/initiate-character/route.ts#L19","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/api/initiate-character/route.ts:86 and src/app/api/rig-character/route.ts:50","ref":"src/app/api/initiate-character/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/initiate-character/route.ts#L86","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/api/initiate-character/route.ts:121 and src/app/api/suggest-names/route.ts:45","ref":"src/app/api/initiate-character/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/initiate-character/route.ts#L121","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/api/task-status/[taskId]/route.ts:124 and src/app/api/task-status/[taskId]/route.ts:142","ref":"src/app/api/task-status/[taskId]/route.ts","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/api/task-status/[taskId]/route.ts#L124","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/character/[characterId]/CharacterViewer.tsx:73 and src/app/character/[characterId]/free/page.tsx:1777","ref":"src/app/character/[characterId]/CharacterViewer.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/character/[characterId]/CharacterViewer.tsx#L73","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/character/[characterId]/free/page.tsx:272 and src/app/character/[characterId]/free/page.tsx:788","ref":"src/app/character/[characterId]/free/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/character/[characterId]/free/page.tsx#L272","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/app/character/[characterId]/page.tsx:83 and src/app/select-existing/page.tsx:211","ref":"src/app/character/[characterId]/page.tsx","url":"https://github.com/arimk/vibefighter/blob/38b460606ac551dc0b94f038b379bb2de51e80b1/src/app/character/[characterId]/page.tsx#L83","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":8.0,"weighted_findings":4.25,"scanned_lines":12288.0,"category:best-practice":3.0,"category:correctness":5.0},"findings":[{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/app/character/[characterId]/free/page.tsx","line":1816,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/app/character/[characterId]/free/page.tsx:1816"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/app/create/page.tsx","line":261,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/app/create/page.tsx:261"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/app/select-existing/page.tsx","line":85,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/app/select-existing/page.tsx:85"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/components/PlayerCharacter.tsx","line":774,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/components/PlayerCharacter.tsx:774"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/components/PlayerCharacter.tsx","line":774,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/components/PlayerCharacter.tsx:774"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/components/PlayerCharacter.tsx","line":774,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/components/PlayerCharacter.tsx:774"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/components/PlayerCharacter.tsx","line":774,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/components/PlayerCharacter.tsx:774"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/components/PlayerCharacter.tsx","line":774,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/components/PlayerCharacter.tsx:774"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":12687.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":44.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":59.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":43.0,"escapes_per_kloc":3.522},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}