{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:03.038593Z","repo":{"ref":{"host":"github.com","owner":"bigadamknight","name":"forge"},"default_branch":"main","clone_url":"https://github.com/bigadamknight/forge.git","html_url":"https://github.com/bigadamknight/forge","description":"Expert knowledge, forged into tools for everyone. Built with Claude Opus 4.6 for the Claude Code Hackathon. Commit after deadline was files modified before the deadline but forgot to commit.","stars":2,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":583,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-02-15T20:06:37Z","pushed_at":"2026-10-29T23:01:53Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-04-25T09:48:22Z","owner_type":"User","release_assets":[]}},"commit_sha":"b272577a30e00bc578481a1e874299cd8713cc29","profile":{"lines_by_language":{"TypeScript":24122,"SQL":345,"JavaScript":24},"files_by_category":{"source":137,"config":22,"test":7,"other":6,"docs":5,"generated":1},"source_lines":24005,"test_lines":486},"pillars":{"ai_provenance":{"score":92.8,"confidence":0.76,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.9281,"suspected_share":0.0,"estimated_share":0.9281,"ai_artifacts":1.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":0.458},"summary":"Explicit AI attribution on 93% of first-party code added; an estimated 93% including velocity signals."},"quality":{"score":53.0,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":54.4,"duplication":56.0,"lint":74.4,"testing":31.0,"docs":65.0,"type_safety":60.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.02, no CI test run detected; 20% of function code in complex or long functions; 10% duplicated lines. Weakest area: testing."},"security":{"score":58.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":96.7,"dependencies":2.9,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 126 known vulnerabilities in 30 dependencies; 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":27.0,"checked":27.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":26.0,"attributed_commits":21.0,"attributed_commit_share":0.8076923076923077,"effective_loc":28007.0,"attributed_loc":25993.0,"attributed_loc_share":0.9280894062198736,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 21 attributed commits, 25,993 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"5ad979574abc7b3813d763e71e5a7376f3b05687","url":"https://github.com/bigadamknight/forge/commit/5ad979574abc7b3813d763e71e5a7376f3b05687","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"0db1c121c3aee10953efa334d39da1b7a9abded5","url":"https://github.com/bigadamknight/forge/commit/0db1c121c3aee10953efa334d39da1b7a9abded5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"66c0375bf88bae4acd232ef495eb379ce069f3f2","url":"https://github.com/bigadamknight/forge/commit/66c0375bf88bae4acd232ef495eb379ce069f3f2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"b2a2c2096f60f6cfe8ecbb8ec90637ed8cd26c3e","url":"https://github.com/bigadamknight/forge/commit/b2a2c2096f60f6cfe8ecbb8ec90637ed8cd26c3e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"d363332477b7a78c5e968f083e6a54e56b0a0268","url":"https://github.com/bigadamknight/forge/commit/d363332477b7a78c5e968f083e6a54e56b0a0268","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"2048b05c474c631f1d97863b6b8c23172fe5a443","url":"https://github.com/bigadamknight/forge/commit/2048b05c474c631f1d97863b6b8c23172fe5a443","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"6688977ace8fb72262b379e9562ae5c36c6b879e","url":"https://github.com/bigadamknight/forge/commit/6688977ace8fb72262b379e9562ae5c36c6b879e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a302e4693bc21c8242efef9dd88f33930d28000b","url":"https://github.com/bigadamknight/forge/commit/a302e4693bc21c8242efef9dd88f33930d28000b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"7a97cbb8d98142b70b16a86aee9d633d50891bde","url":"https://github.com/bigadamknight/forge/commit/7a97cbb8d98142b70b16a86aee9d633d50891bde","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"ac211e0ed4c43f8cc4b7cf522f48b041536443f6","url":"https://github.com/bigadamknight/forge/commit/ac211e0ed4c43f8cc4b7cf522f48b041536443f6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"95d380c16f2c333c6516d6cb1ed6994f1c1b90ff","url":"https://github.com/bigadamknight/forge/commit/95d380c16f2c333c6516d6cb1ed6994f1c1b90ff","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"be69c1d15efb57cdcae5a37ad1ca478dcfc03dd0","url":"https://github.com/bigadamknight/forge/commit/be69c1d15efb57cdcae5a37ad1ca478dcfc03dd0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"7ceb0a0106366f9758f2af068de43eb4953a33cd","url":"https://github.com/bigadamknight/forge/commit/7ceb0a0106366f9758f2af068de43eb4953a33cd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"aff901ce08ec124b6158f5ca5eb7613f45104ea1","url":"https://github.com/bigadamknight/forge/commit/aff901ce08ec124b6158f5ca5eb7613f45104ea1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6ae44ad7e03215cfee37fbccc3763cd08cc25b9c","url":"https://github.com/bigadamknight/forge/commit/6ae44ad7e03215cfee37fbccc3763cd08cc25b9c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a988cfe6eb460b5bf9fe095d909f8afb92f26b7b","url":"https://github.com/bigadamknight/forge/commit/a988cfe6eb460b5bf9fe095d909f8afb92f26b7b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7c71dabdd78ffa9e1f2e759524fe201abd32eb5e","url":"https://github.com/bigadamknight/forge/commit/7c71dabdd78ffa9e1f2e759524fe201abd32eb5e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"634d08c35e5df6627fefef674b95fb6666c71987","url":"https://github.com/bigadamknight/forge/commit/634d08c35e5df6627fefef674b95fb6666c71987","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"78d0e98571ace79217e22c300bc73b4ccfd6c6a9","url":"https://github.com/bigadamknight/forge/commit/78d0e98571ace79217e22c300bc73b4ccfd6c6a9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"383e2f9e209133ead32ca21e22f403a8b7b156ce","url":"https://github.com/bigadamknight/forge/commit/383e2f9e209133ead32ca21e22f403a8b7b156ce","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6a462595bbc4c48ac46d0f509eede2907c3b9445","url":"https://github.com/bigadamknight/forge/commit/6a462595bbc4c48ac46d0f509eede2907c3b9445","weight":0.9}],"data":{"attributed_loc_by_commit":{"6a462595bbc4c48ac46d0f509eede2907c3b9445":13521,"383e2f9e209133ead32ca21e22f403a8b7b156ce":23,"78d0e98571ace79217e22c300bc73b4ccfd6c6a9":3881,"634d08c35e5df6627fefef674b95fb6666c71987":31,"7c71dabdd78ffa9e1f2e759524fe201abd32eb5e":247,"a988cfe6eb460b5bf9fe095d909f8afb92f26b7b":9,"6ae44ad7e03215cfee37fbccc3763cd08cc25b9c":0,"aff901ce08ec124b6158f5ca5eb7613f45104ea1":4490,"7ceb0a0106366f9758f2af068de43eb4953a33cd":0,"be69c1d15efb57cdcae5a37ad1ca478dcfc03dd0":2229,"95d380c16f2c333c6516d6cb1ed6994f1c1b90ff":814,"ac211e0ed4c43f8cc4b7cf522f48b041536443f6":0,"7a97cbb8d98142b70b16a86aee9d633d50891bde":0,"a302e4693bc21c8242efef9dd88f33930d28000b":207,"6688977ace8fb72262b379e9562ae5c36c6b879e":0,"66c0375bf88bae4acd232ef495eb379ce069f3f2":0,"b2a2c2096f60f6cfe8ecbb8ec90637ed8cd26c3e":93,"d363332477b7a78c5e968f083e6a54e56b0a0268":34,"2048b05c474c631f1d97863b6b8c23172fe5a443":316,"0db1c121c3aee10953efa334d39da1b7a9abded5":98,"5ad979574abc7b3813d763e71e5a7376f3b05687":0},"tools":{"claude-code":{"name":"Claude Code","commits":21,"loc":25993,"first_seen":1771158172,"last_seen":1791240590}},"monthly":{"2026-02":{"loc":19717,"attributed_loc":17703},"2026-04":{"loc":9,"attributed_loc":9},"2026-06":{"loc":0,"attributed_loc":0},"2026-07":{"loc":4490,"attributed_loc":4490},"2026-08":{"loc":3250,"attributed_loc":3250},"2026-09":{"loc":0,"attributed_loc":0},"2026-10":{"loc":541,"attributed_loc":541}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1771158172.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1771158172}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":10.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":6115.0,"flagged_loc":2229.0,"flagged_loc_share":0.36451349141455436,"max_loc_per_hour":557.25,"median_loc_per_hour":226.75,"pr_timed_units":0.0,"excluded_import_loc":21892.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,229 lines of first-party code in ~4.0h (557 lines/hour, 1 commit session)","ref":"be69c1d15efb57cdcae5a37ad1ca478dcfc03dd0","url":"https://github.com/bigadamknight/forge/commit/be69c1d15efb57cdcae5a37ad1ca478dcfc03dd0","weight":0.167175}],"data":{"flagged_loc_by_commit":{"be69c1d15efb57cdcae5a37ad1ca478dcfc03dd0":2229},"excluded_import_commits":["6a462595bbc4c48ac46d0f509eede2907c3b9445","78d0e98571ace79217e22c300bc73b4ccfd6c6a9","aff901ce08ec124b6158f5ca5eb7613f45104ea1"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":24005.0,"index":0.458,"count:narrated_steps":11.0,"per_kloc:narrated_steps":0.458,"files:narrated_steps":4.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Plan (skip if confirmed plan provided)","ref":"apps/api/src/routes/tools.ts:153","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/tools.ts#L153","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Deduplicate IDs and assemble","ref":"apps/api/src/routes/tools.ts:204","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/tools.ts#L204","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // first, then those due for review, then oldest successes.","ref":"apps/api/src/services/spaced-repetition.ts:53","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/services/spaced-repetition.ts#L53","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Plan the tool (shows review screen)","ref":"apps/web/src/hooks/useToolDashboard.ts:97","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/hooks/useToolDashboard.ts#L97","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Confirm plan and generate (called after user reviews)","ref":"apps/web/src/hooks/useToolDashboard.ts:184","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/hooks/useToolDashboard.ts#L184","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- Step 1: Create workspaces table","ref":"packages/db/drizzle/0006_workspaces.sql:1","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/packages/db/drizzle/0006_workspaces.sql#L1","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- Step 2: Add workspace_id columns (nullable initially)","ref":"packages/db/drizzle/0006_workspaces.sql:16","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/packages/db/drizzle/0006_workspaces.sql#L16","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- Step 3: Data migration - create workspace for each existing forge","ref":"packages/db/drizzle/0006_workspaces.sql:24","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/packages/db/drizzle/0006_workspaces.sql#L24","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"packages/db/src/seed-demo.ts","line":300,"fingerprint":"packages/db/src/seed-demo.ts:generic-api-key:300"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":8.0,"findings_high":1.0,"findings_medium":0.0,"findings_low":7.0,"weighted_findings":2.237,"scanned_lines":23660.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"apps/api/Dockerfile","line":20,"fingerprint":"dockerfile.security.missing-user:apps/api/Dockerfile:20"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"apps/api/src/lib/embeddings.ts","line":226,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:apps/api/src/lib/embeddings.ts:226"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"apps/api/src/lib/embeddings.ts","line":240,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:apps/api/src/lib/embeddings.ts:240"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"apps/api/src/routes/learn.ts","line":423,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:apps/api/src/routes/learn.ts:423"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"apps/api/src/routes/learn.ts","line":438,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:apps/api/src/routes/learn.ts:438"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"apps/api/src/services/interview-progress.ts","line":102,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:apps/api/src/services/interview-progress.ts:102"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"apps/web/src/components/toolkit/ToolRenderer.tsx","line":54,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:apps/web/src/components/toolkit/ToolRenderer.tsx:54"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"packages/db/src/backfill-embeddings.ts","line":51,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:packages/db/src/backfill-embeddings.ts:51"}],"evidence":[],"data":{"rulesets":["typescript","javascript","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":30.0,"vulnerabilities":126.0,"vulns_critical":2.0,"vulns_high":41.0,"vulns_medium":73.0,"vulns_low":10.0,"vulns_unknown":0.0,"penalty":212.0},"findings":[{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h","path":"yarn.lock","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-w7jw-789q-3m8p","severity":"critical","message":"shell-quote@1.8.3 (npm) is affected by GHSA-w7jw-789q-3m8p","path":"yarn.lock","line":null,"fingerprint":"shell-quote@1.8.3 (npm):GHSA-w7jw-789q-3m8p"},{"rule_id":"osv/GHSA-wc8c-qw6v-h7f6","severity":"high","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-wc8c-qw6v-h7f6","path":"yarn.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-wc8c-qw6v-h7f6"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.26.0 (npm) is affected by GHSA-22jm-h49p-29qw","path":"yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.26.0 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.26.0 (npm) is affected by GHSA-46jr-4wx8-v453","path":"yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.26.0 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.26.0 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.26.0 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.26.0 (npm) is affected by GHSA-f897-62hf-6gxq","path":"yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.26.0 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.2 (npm) is affected by GHSA-27r3-jxmh-p828","path":"yarn.lock","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"yarn.lock","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"yarn.lock","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-gpj5-g38j-94v9","severity":"high","message":"drizzle-orm@0.38.4 (npm) is affected by GHSA-gpj5-g38j-94v9","path":"yarn.lock","line":null,"fingerprint":"drizzle-orm@0.38.4 (npm):GHSA-gpj5-g38j-94v9"},{"rule_id":"osv/GHSA-46wh-pxpv-q5gq","severity":"high","message":"express-rate-limit@8.2.1 (npm) is affected by GHSA-46wh-pxpv-q5gq","path":"yarn.lock","line":null,"fingerprint":"express-rate-limit@8.2.1 (npm):GHSA-46wh-pxpv-q5gq"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-88fw-hqm2-52qc","severity":"high","message":"hono@4.11.9 (npm) is affected by GHSA-88fw-hqm2-52qc","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-88fw-hqm2-52qc"},{"rule_id":"osv/GHSA-q5qw-h33p-qvwr","severity":"high","message":"hono@4.11.9 (npm) is affected by GHSA-q5qw-h33p-qvwr","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-q5qw-h33p-qvwr"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.0.1 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"yarn.lock","line":null,"fingerprint":"ip-address@10.0.1 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"yarn.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"yarn.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"yarn.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-j3q9-mxjg-w52f","severity":"high","message":"path-to-regexp@8.3.0 (npm) is affected by GHSA-j3q9-mxjg-w52f","path":"yarn.lock","line":null,"fingerprint":"path-to-regexp@8.3.0 (npm):GHSA-j3q9-mxjg-w52f"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"yarn.lock","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.3 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"yarn.lock","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-6g55-p6wh-862q","path":"yarn.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-r28c-9q8g-f849","path":"yarn.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-49rj-9fvp-4h2h","severity":"high","message":"react-router@7.13.0 (npm) is affected by GHSA-49rj-9fvp-4h2h","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-49rj-9fvp-4h2h"},{"rule_id":"osv/GHSA-8646-j5j9-6r62","severity":"high","message":"react-router@7.13.0 (npm) is affected by GHSA-8646-j5j9-6r62","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-8646-j5j9-6r62"},{"rule_id":"osv/GHSA-8x6r-g9mw-2r78","severity":"high","message":"react-router@7.13.0 (npm) is affected by GHSA-8x6r-g9mw-2r78","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-8x6r-g9mw-2r78"},{"rule_id":"osv/GHSA-chx6-hx7r-mcp5","severity":"high","message":"react-router@7.13.0 (npm) is affected by GHSA-chx6-hx7r-mcp5","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-chx6-hx7r-mcp5"},{"rule_id":"osv/GHSA-qwww-vcr4-c8h2","severity":"high","message":"react-router@7.13.0 (npm) is affected by GHSA-qwww-vcr4-c8h2","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-qwww-vcr4-c8h2"},{"rule_id":"osv/GHSA-rxv8-25v2-qmq8","severity":"high","message":"react-router@7.13.0 (npm) is affected by GHSA-rxv8-25v2-qmq8","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-rxv8-25v2-qmq8"},{"rule_id":"osv/GHSA-mw96-cpmx-2vgc","severity":"high","message":"rollup@4.57.1 (npm) is affected by GHSA-mw96-cpmx-2vgc","path":"yarn.lock","line":null,"fingerprint":"rollup@4.57.1 (npm):GHSA-mw96-cpmx-2vgc"},{"rule_id":"osv/GHSA-395f-4hp3-45gv","severity":"high","message":"shell-quote@1.8.3 (npm) is affected by GHSA-395f-4hp3-45gv","path":"yarn.lock","line":null,"fingerprint":"shell-quote@1.8.3 (npm):GHSA-395f-4hp3-45gv"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"yarn.lock","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"yarn.lock","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.3.6 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"yarn.lock","line":null,"fingerprint":"zod@4.3.6 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-92pp-h63x-v22m","severity":"medium","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-92pp-h63x-v22m","path":"yarn.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-92pp-h63x-v22m"},{"rule_id":"osv/GHSA-frvp-7c67-39w9","severity":"medium","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-frvp-7c67-39w9","path":"yarn.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-frvp-7c67-39w9"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"yarn.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.26.0 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.26.0 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.26.0 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"yarn.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.26.0 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@8.17.1 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"yarn.lock","line":null,"fingerprint":"ajv@8.17.1 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.9.19 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"yarn.lock","line":null,"fingerprint":"baseline-browser-mapping@2.9.19 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.18.20 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"yarn.lock","line":null,"fingerprint":"esbuild@0.18.20 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.19.12 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"yarn.lock","line":null,"fingerprint":"esbuild@0.19.12 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.21.5 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"yarn.lock","line":null,"fingerprint":"esbuild@0.21.5 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-26pp-8wgv-hjvm","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-26pp-8wgv-hjvm","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-26pp-8wgv-hjvm"},{"rule_id":"osv/GHSA-2gcr-mfcq-wcc3","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-2gcr-mfcq-wcc3","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-2gcr-mfcq-wcc3"},{"rule_id":"osv/GHSA-3hrh-pfw6-9m5x","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-3hrh-pfw6-9m5x","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-3hrh-pfw6-9m5x"},{"rule_id":"osv/GHSA-458j-xx4x-4375","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-458j-xx4x-4375","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-458j-xx4x-4375"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-46wx-v44x-9hh2","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-4h7h-rv7c-7m2v","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-4m76-xfj5-7975","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-5pq2-9x2x-5p6w","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-5pq2-9x2x-5p6w","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-5pq2-9x2x-5p6w"},{"rule_id":"osv/GHSA-69xw-7hcm-h432","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-69xw-7hcm-h432","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-69xw-7hcm-h432"},{"rule_id":"osv/GHSA-8j4g-w8fx-2239","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-8j4g-w8fx-2239","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-8j4g-w8fx-2239"},{"rule_id":"osv/GHSA-9vqf-7f2p-gf9v","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-9vqf-7f2p-gf9v","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-9vqf-7f2p-gf9v"},{"rule_id":"osv/GHSA-crvj-82cr-hjcx","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-crvj-82cr-hjcx","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-crvj-82cr-hjcx"},{"rule_id":"osv/GHSA-f23p-vx2j-j53r","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-f23p-vx2j-j53r","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-f23p-vx2j-j53r"},{"rule_id":"osv/GHSA-f577-qrjj-4474","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-f577-qrjj-4474","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-f577-qrjj-4474"},{"rule_id":"osv/GHSA-g6gw-c38x-mqfc","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-g6gw-c38x-mqfc","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-g6gw-c38x-mqfc"},{"rule_id":"osv/GHSA-gqvv-2mrq-wpjv","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-gqvv-2mrq-wpjv","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-gqvv-2mrq-wpjv"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-h7mg-cq63-vhpq","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-hvrm-45r6-mjfj","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-hvrm-45r6-mjfj","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-hvrm-45r6-mjfj"},{"rule_id":"osv/GHSA-hxh3-vqpv-xpqv","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-hxh3-vqpv-xpqv","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-hxh3-vqpv-xpqv"},{"rule_id":"osv/GHSA-j6c9-x7qj-28xf","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-j6c9-x7qj-28xf","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-j6c9-x7qj-28xf"},{"rule_id":"osv/GHSA-p6xx-57qc-3wxr","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-p6xx-57qc-3wxr","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-p6xx-57qc-3wxr"},{"rule_id":"osv/GHSA-p77w-8qqv-26rm","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-p77w-8qqv-26rm","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-p77w-8qqv-26rm"},{"rule_id":"osv/GHSA-qp7p-654g-cw7p","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-qp7p-654g-cw7p","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-qp7p-654g-cw7p"},{"rule_id":"osv/GHSA-r5rp-j6wh-rvv4","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-r5rp-j6wh-rvv4","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-r5rp-j6wh-rvv4"},{"rule_id":"osv/GHSA-rv63-4mwf-qqc2","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-rv63-4mwf-qqc2","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-rv63-4mwf-qqc2"},{"rule_id":"osv/GHSA-v8w9-8mx6-g223","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-v8w9-8mx6-g223","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-v8w9-8mx6-g223"},{"rule_id":"osv/GHSA-w62v-xxxg-mg59","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-w62v-xxxg-mg59","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-w62v-xxxg-mg59"},{"rule_id":"osv/GHSA-wgpf-jwqj-8h8p","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-wgpf-jwqj-8h8p","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-wgpf-jwqj-8h8p"},{"rule_id":"osv/GHSA-wmmm-f939-6g9c","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-wmmm-f939-6g9c","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-wmmm-f939-6g9c"},{"rule_id":"osv/GHSA-wwfh-h76j-fc44","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-wwfh-h76j-fc44","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-wwfh-h76j-fc44"},{"rule_id":"osv/GHSA-xf4j-xp2r-rqqx","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-xf4j-xp2r-rqqx","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-xf4j-xp2r-rqqx"},{"rule_id":"osv/GHSA-xgm2-5f3f-mvvc","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-xgm2-5f3f-mvvc","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-xgm2-5f3f-mvvc"},{"rule_id":"osv/GHSA-xpcf-pg52-r92g","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-xpcf-pg52-r92g","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-xpcf-pg52-r92g"},{"rule_id":"osv/GHSA-xrhx-7g5j-rcj5","severity":"medium","message":"hono@4.11.9 (npm) is affected by GHSA-xrhx-7g5j-rcj5","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-xrhx-7g5j-rcj5"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.0.1 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"yarn.lock","line":null,"fingerprint":"ip-address@10.0.1 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.0.1 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"yarn.lock","line":null,"fingerprint":"ip-address@10.0.1 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.0.1 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"yarn.lock","line":null,"fingerprint":"ip-address@10.0.1 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.0.1 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"yarn.lock","line":null,"fingerprint":"ip-address@10.0.1 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@10.0.1 (npm) is affected by GHSA-v2v4-37r5-5v8g","path":"yarn.lock","line":null,"fingerprint":"ip-address@10.0.1 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-27v5-c462-wpq7","severity":"medium","message":"path-to-regexp@8.3.0 (npm) is affected by GHSA-27v5-c462-wpq7","path":"yarn.lock","line":null,"fingerprint":"path-to-regexp@8.3.0 (npm):GHSA-27v5-c462-wpq7"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"yarn.lock","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.3 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"yarn.lock","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"yarn.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"yarn.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@6.1.2 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"yarn.lock","line":null,"fingerprint":"postcss-selector-parser@6.1.2 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-w9m9-85wc-3x92","severity":"medium","message":"postcss-selector-parser@6.1.2 (npm) is affected by GHSA-w9m9-85wc-3x92","path":"yarn.lock","line":null,"fingerprint":"postcss-selector-parser@6.1.2 (npm):GHSA-w9m9-85wc-3x92"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.14.2 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"yarn.lock","line":null,"fingerprint":"qs@6.14.2 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.14.2 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"yarn.lock","line":null,"fingerprint":"qs@6.14.2 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.14.2 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"yarn.lock","line":null,"fingerprint":"qs@6.14.2 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.14.2 (npm) is affected by GHSA-x5fp-wj9c-mxmx","path":"yarn.lock","line":null,"fingerprint":"qs@6.14.2 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-2j2x-hqr9-3h42","severity":"medium","message":"react-router@7.13.0 (npm) is affected by GHSA-2j2x-hqr9-3h42","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-2j2x-hqr9-3h42"},{"rule_id":"osv/GHSA-337j-9hxr-rhxg","severity":"medium","message":"react-router@7.13.0 (npm) is affected by GHSA-337j-9hxr-rhxg","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-337j-9hxr-rhxg"},{"rule_id":"osv/GHSA-f22v-gfqf-p8f3","severity":"medium","message":"react-router@7.13.0 (npm) is affected by GHSA-f22v-gfqf-p8f3","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-f22v-gfqf-p8f3"},{"rule_id":"osv/GHSA-h8fp-f39c-q6mh","severity":"medium","message":"react-router@7.13.0 (npm) is affected by GHSA-h8fp-f39c-q6mh","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-h8fp-f39c-q6mh"},{"rule_id":"osv/GHSA-wrjc-x8rr-h8h6","severity":"medium","message":"react-router@7.13.0 (npm) is affected by GHSA-wrjc-x8rr-h8h6","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-wrjc-x8rr-h8h6"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.29.0 (npm) is affected by GHSA-4x5r-pxfx-6jf8","path":"yarn.lock","line":null,"fingerprint":"@babel/core@7.29.0 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-v422-hmwv-36x6","severity":"low","message":"body-parser@2.2.2 (npm) is affected by GHSA-v422-hmwv-36x6","path":"yarn.lock","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-v422-hmwv-36x6"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-333x-w4r6-6crp","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"yarn.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.11.9 (npm) is affected by GHSA-3gg2-335m-rxc6","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-3gg2-335m-rxc6"},{"rule_id":"osv/GHSA-79qm-7rj5-m7r9","severity":"low","message":"hono@4.11.9 (npm) is affected by GHSA-79qm-7rj5-m7r9","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-79qm-7rj5-m7r9"},{"rule_id":"osv/GHSA-gq3j-xvxp-8hrf","severity":"low","message":"hono@4.11.9 (npm) is affected by GHSA-gq3j-xvxp-8hrf","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-gq3j-xvxp-8hrf"},{"rule_id":"osv/GHSA-hm8q-7f3q-5f36","severity":"low","message":"hono@4.11.9 (npm) is affected by GHSA-hm8q-7f3q-5f36","path":"yarn.lock","line":null,"fingerprint":"hono@4.11.9 (npm):GHSA-hm8q-7f3q-5f36"},{"rule_id":"osv/GHSA-84g9-w2xq-vcv6","severity":"low","message":"react-router@7.13.0 (npm) is affected by GHSA-84g9-w2xq-vcv6","path":"yarn.lock","line":null,"fingerprint":"react-router@7.13.0 (npm):GHSA-84g9-w2xq-vcv6"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@5.4.21 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"yarn.lock","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":5.0},"findings":[],"evidence":[{"kind":"posture","description":"apps/api/package.json has no lockfile alongside it (unpinned dependencies)","ref":"apps/api/package.json","url":null,"weight":0.3},{"kind":"posture","description":"apps/web/package.json has no lockfile alongside it (unpinned dependencies)","ref":"apps/web/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/db/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/db/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/mcp/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/mcp/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/shared/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/shared/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1481.0,"function_nloc":15714.0,"mean_ccn":2.44,"p90_ccn":5.0,"complex_functions":18.0,"long_functions":12.0,"many_param_functions":2.0,"risky_nloc_share":0.2031},"findings":[],"evidence":[{"kind":"complex-function","description":"WorkspacePage in apps/web/src/pages/WorkspacePage.tsx: complexity 48, 780 lines","ref":"apps/web/src/pages/WorkspacePage.tsx","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/pages/WorkspacePage.tsx#L60","weight":0.8},{"kind":"complex-function","description":"Quiz in apps/web/src/components/toolkit/Quiz.tsx: complexity 30, 116 lines","ref":"apps/web/src/components/toolkit/Quiz.tsx","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/components/toolkit/Quiz.tsx#L20","weight":0.5},{"kind":"complex-function","description":"QuestionFlow in apps/web/src/components/toolkit/QuestionFlow.tsx: complexity 27, 121 lines","ref":"apps/web/src/components/toolkit/QuestionFlow.tsx","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/components/toolkit/QuestionFlow.tsx#L31","weight":0.45},{"kind":"complex-function","description":"InterviewPage in apps/web/src/pages/InterviewPage.tsx: complexity 27, 404 lines","ref":"apps/web/src/pages/InterviewPage.tsx","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/pages/InterviewPage.tsx#L35","weight":0.45},{"kind":"complex-function","description":"generateJSON in apps/api/src/lib/llm.ts: complexity 22, 48 lines","ref":"apps/api/src/lib/llm.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/lib/llm.ts#L33","weight":0.36666666666666664},{"kind":"complex-function","description":"(anonymous) in apps/api/src/routes/tools.ts: complexity 22, 50 lines","ref":"apps/api/src/routes/tools.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/tools.ts#L747","weight":0.36666666666666664},{"kind":"complex-function","description":"ChatSidebar in apps/web/src/components/toolkit/ChatSidebar.tsx: complexity 22, 142 lines","ref":"apps/web/src/components/toolkit/ChatSidebar.tsx","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/components/toolkit/ChatSidebar.tsx#L32","weight":0.36666666666666664},{"kind":"complex-function","description":"(anonymous) in apps/web/src/components/toolkit/Quiz.tsx: complexity 22, 35 lines","ref":"apps/web/src/components/toolkit/Quiz.tsx","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/web/src/components/toolkit/Quiz.tsx#L308","weight":0.36666666666666664},{"kind":"complex-function","description":"(anonymous) in apps/api/src/routes/voice.ts: complexity 20, 73 lines","ref":"apps/api/src/routes/voice.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/voice.ts#L330","weight":0.3333333333333333},{"kind":"complex-function","description":"(anonymous) in apps/api/src/routes/learn.ts: complexity 19, 76 lines","ref":"apps/api/src/routes/learn.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/learn.ts#L262","weight":0.31666666666666665}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":17709.0,"duplicated_lines":1710.0,"duplicated_share":0.0966,"files":137.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/lib/embeddings.ts:48 and packages/mcp/src/search.ts:12","ref":"apps/api/src/lib/embeddings.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/lib/embeddings.ts#L48","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/lib/embeddings.ts:70 and apps/api/src/lib/embeddings.ts:143","ref":"apps/api/src/lib/embeddings.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/lib/embeddings.ts#L70","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/forges.ts:11 and apps/api/src/routes/workspaces.ts:63","ref":"apps/api/src/routes/forges.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/forges.ts#L11","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/forges.ts:13 and packages/mcp/src/index.ts:55","ref":"apps/api/src/routes/forges.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/forges.ts#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/interviews.ts:125 and apps/api/src/routes/interviews.ts:613","ref":"apps/api/src/routes/interviews.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/interviews.ts#L125","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/interviews.ts:826 and apps/api/src/routes/voice.ts:397","ref":"apps/api/src/routes/interviews.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/interviews.ts#L826","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/tools.ts:50 and apps/api/src/routes/tools.ts:93","ref":"apps/api/src/routes/tools.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/tools.ts#L50","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/tools.ts:533 and apps/api/src/services/expert-context.ts:65","ref":"apps/api/src/routes/tools.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/tools.ts#L533","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/voice.ts:140 and apps/api/src/routes/voice.ts:331","ref":"apps/api/src/routes/voice.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/voice.ts#L140","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/api/src/routes/workspaces.ts:24 and apps/api/src/routes/workspaces.ts:62","ref":"apps/api/src/routes/workspaces.ts","url":"https://github.com/bigadamknight/forge/blob/b272577a30e00bc578481a1e874299cd8713cc29/apps/api/src/routes/workspaces.ts#L24","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":56.0,"weighted_findings":28.0,"scanned_lines":23660.0,"category:best-practice":14.0,"category:correctness":42.0},"findings":[{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how status === 'complete' is evaluated, this expression returns `/workspace/${workspace.id}`. This is probably a copy-paste error.","path":"apps/web/src/pages/HomePage.tsx","line":166,"fingerprint":"typescript.lang.correctness.useless-ternary:apps/web/src/pages/HomePage.tsx:166"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"apps/web/src/components/toolkit/Quiz.tsx","line":33,"fingerprint":"javascript.lang.correctness.no-stringify-keys:apps/web/src/components/toolkit/Quiz.tsx:33"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"apps/web/src/hooks/useTaskBoardState.ts","line":101,"fingerprint":"typescript.react.best-practice.react-props-in-state:apps/web/src/hooks/useTaskBoardState.ts:101"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"apps/web/src/hooks/useToolDashboard.ts","line":56,"fingerprint":"typescript.react.best-practice.react-props-in-state:apps/web/src/hooks/useToolDashboard.ts:56"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"apps/web/src/hooks/useToolDashboard.ts","line":57,"fingerprint":"typescript.react.best-practice.react-props-in-state:apps/web/src/hooks/useToolDashboard.ts:57"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"apps/web/src/hooks/useToolUser.ts","line":26,"fingerprint":"typescript.react.best-practice.react-props-in-state:apps/web/src/hooks/useToolUser.ts:26"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"apps/web/src/hooks/useToolUser.ts","line":27,"fingerprint":"typescript.react.best-practice.react-props-in-state:apps/web/src/hooks/useToolUser.ts:27"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":47,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:47"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":49,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:49"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":51,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:51"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":53,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:53"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":55,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:55"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":63,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:63"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":86,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:86"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":88,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:88"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/web/src/lib/renderComponent.tsx","line":90,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/web/src/lib/renderComponent.tsx:90"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/forges.ts","line":105,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/forges.ts:105"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/forges.ts","line":131,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/forges.ts:131"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/interviews.ts","line":711,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/interviews.ts:711"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/tools.ts","line":340,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/tools.ts:340"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/tools.ts","line":573,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/tools.ts:573"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/tools.ts","line":599,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/tools.ts:599"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/tools.ts","line":599,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/tools.ts:599"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/tools.ts","line":722,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/tools.ts:722"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/routes/voice.ts","line":39,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/routes/voice.ts:39"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/extractor.ts","line":57,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/extractor.ts:57"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/interview-planner.ts","line":28,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/interview-planner.ts:28"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/interview-planner.ts","line":114,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/interview-planner.ts:114"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/interview-planner.ts","line":169,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/interview-planner.ts:169"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/interview-planner.ts","line":228,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/interview-planner.ts:228"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/intro-extractor.ts","line":26,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/intro-extractor.ts:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/spaced-repetition.ts","line":120,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/spaced-repetition.ts:120"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/spaced-repetition.ts","line":120,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/spaced-repetition.ts:120"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":52,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:52"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":52,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:52"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":58,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:58"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":58,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:58"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":64,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:64"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":64,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:64"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":69,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:69"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":69,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:69"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":77,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:77"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":77,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:77"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":97,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:97"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":97,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:97"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":109,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:109"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":109,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:109"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/tool-generator.ts","line":254,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/tool-generator.ts:254"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/unit-generator.ts","line":115,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/unit-generator.ts:115"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/unit-generator.ts","line":115,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/unit-generator.ts:115"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/services/validator.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/services/validator.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/web/src/components/toolkit/Calculator.tsx","line":180,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/web/src/components/toolkit/Calculator.tsx:180"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/web/src/components/toolkit/Calculator.tsx","line":180,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/web/src/components/toolkit/Calculator.tsx:180"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/web/src/components/toolkit/Calculator.tsx","line":180,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/web/src/components/toolkit/Calculator.tsx:180"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0405,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":486.0,"source_lines":24005.0,"test_ratio":0.0202,"ci_files":0.0,"cochange_share":0.25,"cochange_commits":16.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":88.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":176.0,"escapes_per_kloc":7.446},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: apps/web/tsconfig.json","ref":"apps/web/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":22399.0,"other_lines":1606.0,"files_blamed":137.0,"blame_failures":0.0,"quality:ai_findings":54.0,"quality:ai_per_kloc":2.411,"quality:other_findings":2.0,"quality:other_per_kloc":1.245,"quality:ratio":1.94,"security:ai_findings":7.0,"security:ai_per_kloc":0.313,"security:other_findings":1.0,"security:other_per_kloc":0.623,"security:ratio":0.5},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":["unreviewed-ai-risk"]}