{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:03.487876Z","repo":{"ref":{"host":"github.com","owner":"chrislusf","name":"glow"},"default_branch":"master","clone_url":"https://github.com/chrislusf/glow.git","html_url":"https://github.com/chrislusf/glow","description":"Glow is an easy-to-use distributed computation system written in Go, similar to Hadoop Map Reduce, Spark, Flink, Storm, etc. I am also working on another similar pure Go system, https://github.com/chrislusf/gleam , which is more flexible and more performant.","stars":3217,"forks":247,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":35626,"primary_language":"Go","license_spdx":null,"created_at":"2015-06-14T00:33:48Z","pushed_at":"2018-11-02T06:09:14Z","security_policy_url":null,"distribution":{"owner_created_at":"2012-03-16T07:17:44Z","owner_type":"User","release_assets":[]}},"commit_sha":"4c40a2717eee6512247ce30ab8a8428348d6d9e9","profile":{"lines_by_language":{"Go":8673,"Shell":77},"files_by_category":{"source":87,"test":17,"binary":11,"other":10,"config":9,"docs":7,"generated":1,"oversized":1},"source_lines":7781,"test_lines":969},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":65.5,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":93.7,"duplication":72.0,"lint":81.2,"testing":64.1,"docs":40.0,"type_safety":null,"process":5.0},"summary":"Code quality is adequate: test-to-source ratio 0.12, CI runs tests; 2% of function code in complex or long functions; 5% duplicated lines. Weakest area: process."},"security":{"score":41.1,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":43.5,"sast":66.7,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":25.0},"summary":"Security posture is poor: 2 possible secret(s) in the tree, 0 only in history; 3 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":1.6,"check:Code-Review":1.0,"check:Maintained":0.0,"check:Binary-Artifacts":10.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:License":0.0,"check:Fuzzing":0.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 1/10 (Found 3/21 approved changesets -- score normalized to 1)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":0.9},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 0/10 (license file not detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/chrislusf/glow","weight":1.0}],"data":{"date":"2026-11-09","commit":"4c40a2717eee6512247ce30ab8a8428348d6d9e9","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":293.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":13453.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2015-07":{"loc":1089,"attributed_loc":0},"2015-09":{"loc":4905,"attributed_loc":0},"2015-10":{"loc":2993,"attributed_loc":0},"2015-11":{"loc":948,"attributed_loc":0},"2015-12":{"loc":147,"attributed_loc":0},"2016-01":{"loc":1613,"attributed_loc":0},"2016-02":{"loc":707,"attributed_loc":0},"2016-03":{"loc":88,"attributed_loc":0},"2016-04":{"loc":92,"attributed_loc":0},"2016-05":{"loc":1,"attributed_loc":0},"2016-06":{"loc":0,"attributed_loc":0},"2016-07":{"loc":690,"attributed_loc":0},"2016-08":{"loc":163,"attributed_loc":0},"2016-09":{"loc":9,"attributed_loc":0},"2016-10":{"loc":0,"attributed_loc":0},"2017-07":{"loc":8,"attributed_loc":0},"2018-10":{"loc":0,"attributed_loc":0},"2018-11":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":131.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":9980.0,"pre_ai_era_burst_loc":0.0,"measured_loc":9980.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":358.0,"median_loc_per_hour":47.80613577023499,"pr_timed_units":6.0,"excluded_import_loc":3473.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["ecdf5fa6859e03e5b76d5bcea9acc6a352687dc4"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7781.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":2.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"util/test_certs/server.key","line":1,"fingerprint":"util/test_certs/server.key:private-key:1"},{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"util/test_certs/client.key","line":1,"fingerprint":"util/test_certs/client.key:private-key:1"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"findings_high":3.0,"findings_medium":10.0,"findings_low":0.0,"weighted_findings":9.0,"scanned_lines":7781.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":9,"fingerprint":"dockerfile.security.missing-user-entrypoint:Dockerfile:9"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":10,"fingerprint":"dockerfile.security.missing-user:Dockerfile:10"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"agent/agent_server_executor_start.go","line":44,"fingerprint":"go.lang.security.audit.dangerous-exec-command:agent/agent_server_executor_start.go:44"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"driver/scheduler/scheduler_fetch.go","line":7,"fingerprint":"go.lang.security.audit.crypto.math-random-used:driver/scheduler/scheduler_fetch.go:7"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"netchan/cert_files.go","line":57,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:netchan/cert_files.go:57"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"netchan/receiver/receiver_channel.go","line":8,"fingerprint":"go.lang.security.audit.crypto.math-random-used:netchan/receiver/receiver_channel.go:8"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"resource/service_discovery/client/heartbeater.go","line":5,"fingerprint":"go.lang.security.audit.crypto.math-random-used:resource/service_discovery/client/heartbeater.go:5"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"resource/service_discovery/master/master_allocation.go","line":5,"fingerprint":"go.lang.security.audit.crypto.math-random-used:resource/service_discovery/master/master_allocation.go:5"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"util/http_handler.go","line":31,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:util/http_handler.go:31"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"util/http_handler.go","line":39,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:util/http_handler.go:39"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"util/http_handler.go","line":43,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:util/http_handler.go:43"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-fprintf-to-responsewriter","severity":"medium","message":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low]","path":"util/http_handler.go","line":47,"fingerprint":"go.lang.security.audit.xss.no-fprintf-to-responsewriter:util/http_handler.go:47"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"util/http_handler.go","line":48,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:util/http_handler.go:48"}],"evidence":[],"data":{"rulesets":["go","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.005,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":535.0,"function_nloc":5149.0,"mean_ccn":2.35,"p90_ccn":5.0,"complex_functions":2.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0216},"findings":[],"evidence":[{"kind":"complex-function","description":"anonymous__0 in flow/dataset_join.go: complexity 27, 71 lines","ref":"flow/dataset_join.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/flow/dataset_join.go#L29","weight":0.45},{"kind":"complex-function","description":"_getLessThanComparatorByKeyValue in flow/dataset_sort_comparator.go: complexity 16, 40 lines","ref":"flow/dataset_sort_comparator.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/flow/dataset_sort_comparator.go#L9","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5192.0,"duplicated_lines":284.0,"duplicated_share":0.0547,"files":87.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: driver/context_driver_on_interrupt.go:31 and driver/context_driver_on_interrupt.go:90","ref":"driver/context_driver_on_interrupt.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/driver/context_driver_on_interrupt.go#L31","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: driver/plan/group_plot.go:27 and driver/plan/group_plot.go:144","ref":"driver/plan/group_plot.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/driver/plan/group_plot.go#L27","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: driver/rsync/http_server.go:95 and resource/service_discovery/master/master.go:55","ref":"driver/rsync/http_server.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/driver/rsync/http_server.go#L95","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: driver/scheduler/market/cda_market.go:115 and driver/scheduler/market/cda_market.go:137","ref":"driver/scheduler/market/cda_market.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/driver/scheduler/market/cda_market.go#L115","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/hdfs_source/hdfs_source.go:22 and examples/word_count/word_count.go:51","ref":"examples/hdfs_source/hdfs_source.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/examples/hdfs_source/hdfs_source.go#L22","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/word_count/word_count.go:173 and examples/word_count/word_count.go:215","ref":"examples/word_count/word_count.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/examples/word_count/word_count.go#L173","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: flow/dataset_cogroup.go:30 and flow/dataset_cogroup.go:92","ref":"flow/dataset_cogroup.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/flow/dataset_cogroup.go#L30","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: flow/dataset_cogroup.go:75 and flow/dataset_join.go:29","ref":"flow/dataset_cogroup.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/flow/dataset_cogroup.go#L75","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: flow/dataset_join_utils.go:9 and flow/dataset_join_utils.go:19","ref":"flow/dataset_join_utils.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/flow/dataset_join_utils.go#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: flow/dataset_output.go:32 and flow/dataset_output.go:61","ref":"flow/dataset_output.go","url":"https://github.com/chrislusf/glow/blob/4c40a2717eee6512247ce30ab8a8428348d6d9e9/flow/dataset_output.go#L32","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":8.0,"weighted_findings":6.5,"scanned_lines":7781.0,"category:correctness":8.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"agent/agent_server_executor_start.go","line":27,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:agent/agent_server_executor_start.go:27"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"driver/rsync/fetch_url.go","line":64,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:driver/rsync/fetch_url.go:64"},{"rule_id":"opengrep/go.lang.correctness.use-filepath-join","severity":"medium","message":"`path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators.","path":"netchan/store/data_store.go","line":26,"fingerprint":"go.lang.correctness.use-filepath-join:netchan/store/data_store.go:26"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"netchan/store/rotating_file_store.go","line":205,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:netchan/store/rotating_file_store.go:205"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"netchan/store/rotating_file_store.go","line":272,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:netchan/store/rotating_file_store.go:272"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"netchan/store/rotating_file_store.go","line":346,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:netchan/store/rotating_file_store.go:346"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"etc/start_local_glow_cluster.sh","line":22,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:etc/start_local_glow_cluster.sh:22"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"etc/start_local_glow_cluster.sh","line":25,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:etc/start_local_glow_cluster.sh:25"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2491,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.2842,"test_lines":969.0,"source_lines":7781.0,"test_ratio":0.1245,"ci_files":1.0,"cochange_share":0.071,"cochange_commits":183.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":97.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}