{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:03.149141Z","repo":{"ref":{"host":"github.com","owner":"brackets-userland","name":"brackets-git"},"default_branch":"master","clone_url":"https://github.com/brackets-userland/brackets-git.git","html_url":"https://github.com/brackets-userland/brackets-git","description":"brackets-git — git extension for adobe/brackets","stars":651,"forks":185,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":6053,"primary_language":"TypeScript","license_spdx":"NOASSERTION","created_at":"2013-08-15T05:37:27Z","pushed_at":"2020-08-03T14:02:13Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-11-26T08:45:08Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"334b702d2a35f62a2a863b9aaa25d1bec95c7ed7","profile":{"lines_by_language":{"TypeScript":8058,"JavaScript":2814,"Shell":14},"files_by_category":{"source":58,"other":51,"binary":11,"config":10,"docs":7,"oversized":1},"source_lines":10886,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.184},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":69.6,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":89.9,"duplication":93.9,"lint":98.9,"testing":15.0,"docs":100.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.00, no CI test run detected; 4% of function code in complex or long functions; 1% duplicated lines. Weakest area: testing."},"security":{"score":70.4,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":68.5,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 5 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":29.0,"checked":29.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1319.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":42844.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2013-08":{"loc":3048,"attributed_loc":0},"2013-09":{"loc":1649,"attributed_loc":0},"2013-10":{"loc":239,"attributed_loc":0},"2013-11":{"loc":69,"attributed_loc":0},"2013-12":{"loc":670,"attributed_loc":0},"2014-01":{"loc":674,"attributed_loc":0},"2014-02":{"loc":1553,"attributed_loc":0},"2014-03":{"loc":10312,"attributed_loc":0},"2014-04":{"loc":9840,"attributed_loc":0},"2014-05":{"loc":244,"attributed_loc":0},"2014-06":{"loc":115,"attributed_loc":0},"2014-07":{"loc":491,"attributed_loc":0},"2014-08":{"loc":220,"attributed_loc":0},"2014-09":{"loc":1039,"attributed_loc":0},"2014-10":{"loc":398,"attributed_loc":0},"2014-11":{"loc":145,"attributed_loc":0},"2014-12":{"loc":472,"attributed_loc":0},"2015-01":{"loc":1,"attributed_loc":0},"2015-02":{"loc":116,"attributed_loc":0},"2015-03":{"loc":747,"attributed_loc":0},"2015-04":{"loc":139,"attributed_loc":0},"2015-05":{"loc":21,"attributed_loc":0},"2015-07":{"loc":0,"attributed_loc":0},"2015-08":{"loc":81,"attributed_loc":0},"2015-09":{"loc":0,"attributed_loc":0},"2015-12":{"loc":113,"attributed_loc":0},"2016-01":{"loc":228,"attributed_loc":0},"2016-02":{"loc":1,"attributed_loc":0},"2016-03":{"loc":2,"attributed_loc":0},"2016-04":{"loc":2,"attributed_loc":0},"2016-05":{"loc":169,"attributed_loc":0},"2016-08":{"loc":8,"attributed_loc":0},"2016-09":{"loc":7488,"attributed_loc":0},"2016-10":{"loc":447,"attributed_loc":0},"2016-11":{"loc":833,"attributed_loc":0},"2016-12":{"loc":396,"attributed_loc":0},"2017-01":{"loc":631,"attributed_loc":0},"2017-07":{"loc":242,"attributed_loc":0},"2018-01":{"loc":1,"attributed_loc":0},"2018-04":{"loc":0,"attributed_loc":0},"2018-08":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":619.0,"flagged_units":0.0,"pre_ai_era_bursts":3.0,"pre_ai_era_measured_loc":40577.0,"pre_ai_era_burst_loc":7906.0,"measured_loc":40577.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":932.25,"median_loc_per_hour":70.5,"pr_timed_units":1.0,"excluded_import_loc":2267.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["caf20e939035f722f465e70a6390c96752a2523b"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":2.0,"flagged_releases":0.0,"max_loc_per_day":1.4},"findings":[],"evidence":[],"data":{"releases":[{"from":"v-0.14.27","to":"v0.14.28","loc":57,"days":77.81,"loc_per_day":0.7,"flagged":false},{"from":"v0.14.28","to":"v0.16.6","loc":547,"days":386.54,"loc_per_day":1.4,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":10886.0,"index":0.184,"count:narrated_steps":2.0,"per_kloc:narrated_steps":0.184,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // now we launch a diff to fill the gutters in our editors","ref":"src/GutterManager.ts:255","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/GutterManager.ts#L255","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // now we are going to be paranoid and we will check if some mofo didn't change our diff","ref":"src/Panel.ts:276","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/Panel.ts#L276","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":37.0,"findings_high":5.0,"findings_medium":32.0,"findings_low":0.0,"weighted_findings":11.75,"scanned_lines":10886.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `args`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/node/cli.ts","line":40,"fingerprint":"javascript.lang.security.detect-child-process:src/node/cli.ts:40"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/node/cli.ts","line":40,"fingerprint":"javascript.lang.security.detect-child-process:src/node/cli.ts:40"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/node/cli.ts","line":70,"fingerprint":"javascript.lang.security.detect-child-process:src/node/cli.ts:70"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `pid`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/node/process-utils.ts","line":32,"fingerprint":"javascript.lang.security.detect-child-process:src/node/process-utils.ts:32"},{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `pid`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"src/node/process-utils.ts","line":37,"fingerprint":"javascript.lang.security.detect-child-process:src/node/process-utils.ts:37"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lang` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"nls/generate.js","line":18,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:nls/generate.js:18"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `lang` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"nls/generate.js","line":58,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:nls/generate.js:58"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"src/Branch.ts","line":144,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:src/Branch.ts:144"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Branch.ts","line":336,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Branch.ts:336"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ChangelogDialog.ts","line":19,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:src/ChangelogDialog.ts:19"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"src/ChangelogDialog.ts","line":19,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:src/ChangelogDialog.ts:19"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/Cli.ts","line":168,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/Cli.ts:168"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"src/HistoryViewer.ts","line":52,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:src/HistoryViewer.ts:52"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Panel.ts","line":957,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Panel.ts:957"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Panel.ts","line":961,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Panel.ts:961"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Panel.ts","line":965,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Panel.ts:965"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Panel.ts","line":968,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Panel.ts:968"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Panel.ts","line":977,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Panel.ts:977"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Panel.ts","line":1144,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Panel.ts:1144"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `_line` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"src/ProjectTreeMarks.ts","line":87,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/ProjectTreeMarks.ts:87"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"src/Remotes.ts","line":96,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:src/Remotes.ts:96"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Remotes.ts","line":312,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Remotes.ts:312"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/Remotes.ts","line":322,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/Remotes.ts:322"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/Utils.ts","line":339,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/Utils.ts:339"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"src/dialogs/RemoteCommon.ts","line":15,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:src/dialogs/RemoteCommon.ts:15"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"src/ftp/Ftp.ts","line":131,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:src/ftp/Ftp.ts:131"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/node/cli.ts","line":196,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/node/cli.ts:196"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `_path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/node/process-utils.ts","line":89,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/node/process-utils.ts:89"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/format-diff.html","line":11,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/format-diff.html:11"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/git-diff-dialog.html","line":3,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/git-diff-dialog.html:3"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/git-output.html","line":8,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/git-output.html:8"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/git-question-dialog.html","line":6,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/git-question-dialog.html:6"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/git-settings-dialog.html","line":138,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/git-settings-dialog.html:138"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/git-settings-dialog.html","line":163,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/git-settings-dialog.html:163"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/git-settings-dialog.html","line":230,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/git-settings-dialog.html:230"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/git-settings-dialog.html","line":240,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/git-settings-dialog.html:240"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.template-explicit-unescape","severity":"medium","message":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location. [confidence low]","path":"templates/history-viewer.html","line":53,"fingerprint":"javascript.express.security.audit.xss.mustache.template-explicit-unescape:templates/history-viewer.html:53"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.02,"unpinned_manifests":2.0},"findings":[],"evidence":[{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3},{"kind":"posture","description":"src/node/package.json has no lockfile alongside it (unpinned dependencies)","ref":"src/node/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1014.0,"function_nloc":6597.0,"mean_ccn":1.8,"p90_ccn":3.0,"complex_functions":4.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0356},"findings":[],"evidence":[{"kind":"complex-function","description":"handleToggleHistory in src/History.ts: complexity 21, 50 lines","ref":"src/History.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/History.ts#L246","weight":0.35},{"kind":"complex-function","description":"(anonymous) in src/Utils.ts: complexity 21, 85 lines","ref":"src/Utils.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/Utils.ts#L59","weight":0.35},{"kind":"complex-function","description":"(anonymous) in src/git/GitCli.ts: complexity 21, 69 lines","ref":"src/git/GitCli.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/git/GitCli.ts#L655","weight":0.35},{"kind":"complex-function","description":"(anonymous) in src/git/Git.ts: complexity 19, 31 lines","ref":"src/git/Git.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/git/Git.ts#L25","weight":0.31666666666666665}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":7998.0,"duplicated_lines":84.0,"duplicated_share":0.0105,"files":58.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/History.ts:84 and src/History.ts:137","ref":"src/History.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/History.ts#L84","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/dialogs/Pull.ts:29 and src/dialogs/Push.ts:28","ref":"src/dialogs/Pull.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/dialogs/Pull.ts#L29","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/git/GitCli.ts:1016 and src/git/GitCli.ts:1032","ref":"src/git/GitCli.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/git/GitCli.ts#L1016","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/node/cli.ts:226 and src/node/cli.ts:243","ref":"src/node/cli.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/node/cli.ts#L226","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/node/process-utils.ts:49 and src/node/process-utils.ts:64","ref":"src/node/process-utils.ts","url":"https://github.com/brackets-userland/brackets-git/blob/334b702d2a35f62a2a863b9aaa25d1bec95c7ed7/src/node/process-utils.ts#L49","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":0.5,"scanned_lines":10886.0,"category:best-practice":2.0},"findings":[{"rule_id":"opengrep/typescript.lang.best-practice.moment-deprecated","severity":"low","message":"Moment is a legacy project in maintenance mode. Consider using libraries that are actively supported, e.g. `dayjs`.","path":"src/History.ts","line":3,"fingerprint":"typescript.lang.best-practice.moment-deprecated:src/History.ts:3"},{"rule_id":"opengrep/typescript.lang.best-practice.moment-deprecated","severity":"low","message":"Moment is a legacy project in maintenance mode. Consider using libraries that are actively supported, e.g. `dayjs`.","path":"src/Panel.ts","line":8,"fingerprint":"typescript.lang.best-practice.moment-deprecated:src/Panel.ts:8"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":10886.0,"test_ratio":0.0,"ci_files":1.0,"cochange_share":0.0,"cochange_commits":181.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":82.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":11.0,"escapes_per_kloc":1.365},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}