{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:03.526494Z","repo":{"ref":{"host":"github.com","owner":"cln-io","name":"mattermost-bridge"},"default_branch":"main","clone_url":"https://github.com/cln-io/mattermost-bridge.git","html_url":"https://github.com/cln-io/mattermost-bridge","description":"A TypeScript-based bridge that seamlessly forwards messages between channels on different Mattermost instances. Features profile picture sync, file attachments, MFA support, and domain filtering. Uses regular user accounts - no bot setup required. Multi-arch Docker images available.","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3697,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2025-06-29T13:59:47Z","pushed_at":"2026-08-20T22:32:40Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-06-14T12:51:29Z","owner_type":"User","release_assets":[]}},"commit_sha":"d212c79eff2291f553e39e5e44a42c63d709e541","profile":{"lines_by_language":{"TypeScript":6709,"Shell":1373,"JavaScript":96},"files_by_category":{"source":23,"test":11,"config":9,"docs":4,"binary":3,"other":2,"oversized":2,"generated":1},"source_lines":5192,"test_lines":2986},"pillars":{"ai_provenance":{"score":6.4,"confidence":0.93,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0637,"suspected_share":0.0,"estimated_share":0.0637,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":47.862},"summary":"Explicit AI attribution on 6% of first-party code added; an estimated 6% including velocity signals."},"quality":{"score":65.5,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":34.1,"duplication":78.1,"lint":56.1,"testing":90.0,"docs":65.0,"type_safety":60.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.58, CI runs tests; 36% of function code in complex or long functions; 4% duplicated lines. Weakest area: complexity."},"security":{"score":50.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":90.5,"sast":80.0,"dependencies":29.1,"ci_actions":6.7,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 55 known vulnerabilities in 12 dependencies; 14 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":13.0,"checked":13.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":93.0,"attributed_commits":16.0,"attributed_commit_share":0.17204301075268819,"effective_loc":9200.0,"attributed_loc":586.0,"attributed_loc_share":0.06369565217391304,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 16 attributed commits, 586 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: on merged branch (5b3c31683b)","ref":"533a05b0814ccb4d5273609f59d2a5b5421fcf95","url":"https://github.com/cln-io/mattermost-bridge/commit/533a05b0814ccb4d5273609f59d2a5b5421fcf95","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (5b3c31683b)","ref":"bc5257773aa5eaf29a8942ff199a8450a267d72a","url":"https://github.com/cln-io/mattermost-bridge/commit/bc5257773aa5eaf29a8942ff199a8450a267d72a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (2a01625ff7)","ref":"8bc40c84c61277b4bd5e75e72ac7ebd417f0c1d4","url":"https://github.com/cln-io/mattermost-bridge/commit/8bc40c84c61277b4bd5e75e72ac7ebd417f0c1d4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (2a01625ff7)","ref":"1c139b3c368449778be009cef8da533c374cedee","url":"https://github.com/cln-io/mattermost-bridge/commit/1c139b3c368449778be009cef8da533c374cedee","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f612ed3ba31a61386672bb904b04a77f2a637dd5","url":"https://github.com/cln-io/mattermost-bridge/commit/f612ed3ba31a61386672bb904b04a77f2a637dd5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9091b2be094f0fbdfa2df429cf05114830310252","url":"https://github.com/cln-io/mattermost-bridge/commit/9091b2be094f0fbdfa2df429cf05114830310252","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"33f4372fb06c8eb80503a7a23127c8a0ad397c84","url":"https://github.com/cln-io/mattermost-bridge/commit/33f4372fb06c8eb80503a7a23127c8a0ad397c84","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"aae3a4b9b2b79897292d6541f36e17ea74f089d9","url":"https://github.com/cln-io/mattermost-bridge/commit/aae3a4b9b2b79897292d6541f36e17ea74f089d9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"76004a5fae4b7e7029c7925f05eaed4cb8f48142","url":"https://github.com/cln-io/mattermost-bridge/commit/76004a5fae4b7e7029c7925f05eaed4cb8f48142","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5f2878c29d84653f94f4076097035c5d2b9005d4","url":"https://github.com/cln-io/mattermost-bridge/commit/5f2878c29d84653f94f4076097035c5d2b9005d4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"23e198680640f1fbcc15b8118b7864764af29322","url":"https://github.com/cln-io/mattermost-bridge/commit/23e198680640f1fbcc15b8118b7864764af29322","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2153b57e11980be1aa64e792b60a8f9d4a9a67a5","url":"https://github.com/cln-io/mattermost-bridge/commit/2153b57e11980be1aa64e792b60a8f9d4a9a67a5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"96e4d80721133c3eec3522633950449b40e67362","url":"https://github.com/cln-io/mattermost-bridge/commit/96e4d80721133c3eec3522633950449b40e67362","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"aa2304a68f8b19f97c9b9490d0fac7a833c969fa","url":"https://github.com/cln-io/mattermost-bridge/commit/aa2304a68f8b19f97c9b9490d0fac7a833c969fa","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"0be6ec800a6d312f2c53f3d494009dd722b26631","url":"https://github.com/cln-io/mattermost-bridge/commit/0be6ec800a6d312f2c53f3d494009dd722b26631","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3dca315d46145055a80b2ef93dfcb97ac36217e3","url":"https://github.com/cln-io/mattermost-bridge/commit/3dca315d46145055a80b2ef93dfcb97ac36217e3","weight":0.9}],"data":{"attributed_loc_by_commit":{"3dca315d46145055a80b2ef93dfcb97ac36217e3":47,"0be6ec800a6d312f2c53f3d494009dd722b26631":5,"aa2304a68f8b19f97c9b9490d0fac7a833c969fa":23,"96e4d80721133c3eec3522633950449b40e67362":2,"2153b57e11980be1aa64e792b60a8f9d4a9a67a5":37,"23e198680640f1fbcc15b8118b7864764af29322":59,"5f2878c29d84653f94f4076097035c5d2b9005d4":66,"76004a5fae4b7e7029c7925f05eaed4cb8f48142":48,"aae3a4b9b2b79897292d6541f36e17ea74f089d9":0,"33f4372fb06c8eb80503a7a23127c8a0ad397c84":71,"9091b2be094f0fbdfa2df429cf05114830310252":5,"f612ed3ba31a61386672bb904b04a77f2a637dd5":68,"1c139b3c368449778be009cef8da533c374cedee":0,"8bc40c84c61277b4bd5e75e72ac7ebd417f0c1d4":153,"bc5257773aa5eaf29a8942ff199a8450a267d72a":0,"533a05b0814ccb4d5273609f59d2a5b5421fcf95":2},"tools":{"claude-code":{"name":"Claude Code","commits":16,"loc":586,"first_seen":1754902694,"last_seen":1770798673}},"monthly":{"2025-07":{"loc":6866,"attributed_loc":0},"2025-08":{"loc":623,"attributed_loc":114},"2025-09":{"loc":228,"attributed_loc":125},"2025-10":{"loc":192,"attributed_loc":192},"2025-11":{"loc":0,"attributed_loc":0},"2026-02":{"loc":472,"attributed_loc":155},"2026-03":{"loc":693,"attributed_loc":0},"2026-04":{"loc":0,"attributed_loc":0},"2026-05":{"loc":126,"attributed_loc":0},"2026-06":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":34.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":6484.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":459.98140523309866,"median_loc_per_hour":46.75,"pr_timed_units":0.0,"excluded_import_loc":2716.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["d750cea8684c2026c69e1564bdf4d5e3cf6ac4a3"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":5192.0,"index":47.862,"count:narrated_steps":38.0,"per_kloc:narrated_steps":7.319,"files:narrated_steps":5.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":421.0,"per_kloc:emoji_in_code":81.086,"files:emoji_in_code":18.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 1: Install dependencies if node_modules doesn't exist","ref":"build.sh:34","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L34","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 2: Clean and compile TypeScript","ref":"build.sh:45","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L45","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 3: Setup Docker buildx for multi-platform builds","ref":"build.sh:71","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L71","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 4: Determine build settings","ref":"build.sh:99","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L99","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 5: Build Docker image","ref":"build.sh:147","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L147","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 5: Display image info","ref":"build.sh:177","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L177","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 6: Test the image (only for local builds)","ref":"build.sh:183","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L183","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 1: Setup Docker buildx","ref":"push-live.sh:52","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/push-live.sh#L52","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":2.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"build.sh","line":205,"fingerprint":"build.sh:generic-api-key:205"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":".env.template","line":13,"fingerprint":".env.template:generic-api-key:13"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit d750cea868); removed from the current tree but still retrievable","path":"README.md","line":163,"fingerprint":"d750cea8684c2026c69e1564bdf4d5e3cf6ac4a3:README.md:generic-api-key:163"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":53.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":53.0,"weighted_findings":3.312,"scanned_lines":5192.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":215,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:215"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":396,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:396"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":493,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:493"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":507,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:507"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":594,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:594"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":751,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:751"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":857,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:857"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":960,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:960"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":1034,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:1034"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/bridge.ts","line":1051,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/bridge.ts:1051"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/heartbeat-service.ts","line":89,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/heartbeat-service.ts:89"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/heartbeat-service.ts","line":92,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/heartbeat-service.ts:92"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/index.ts","line":82,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/index.ts:82"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/index.ts","line":90,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/index.ts:90"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/index.ts","line":101,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/index.ts:101"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":81,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:81"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":103,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:103"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":232,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:232"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":238,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:238"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":288,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:288"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":304,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:304"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":318,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:318"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":343,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:343"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":354,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:354"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":364,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:364"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":375,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:375"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":403,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:403"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":427,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:427"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":449,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:449"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":459,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:459"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":487,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:487"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":497,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:497"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":516,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:516"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":542,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:542"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":568,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:568"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":593,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:593"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":632,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:632"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":644,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:644"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":661,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:661"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":684,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:684"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":694,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:694"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":717,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:717"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":754,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:754"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":925,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:925"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":1114,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:1114"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":1119,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:1119"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":1133,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:1133"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":1135,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:1135"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":1381,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:1381"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":1438,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:1438"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/mattermost-client.ts","line":1543,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/mattermost-client.ts:1543"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/message-tracker.ts","line":78,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/message-tracker.ts:78"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/message-tracker.ts","line":97,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/message-tracker.ts:97"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":12.0,"vulnerabilities":55.0,"vulns_critical":0.0,"vulns_high":32.0,"vulns_medium":21.0,"vulns_low":2.0,"vulns_unknown":0.0,"penalty":74.0},"findings":[{"rule_id":"osv/GHSA-35jp-ww65-95wh","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-35jp-ww65-95wh","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-35jp-ww65-95wh"},{"rule_id":"osv/GHSA-3pq3-5fj3-cg6v","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-3pq3-5fj3-cg6v","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-3pq3-5fj3-cg6v"},{"rule_id":"osv/GHSA-542g-h47m-68v8","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-542g-h47m-68v8","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-542g-h47m-68v8"},{"rule_id":"osv/GHSA-777c-7fjr-54vf","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-777c-7fjr-54vf","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-777c-7fjr-54vf"},{"rule_id":"osv/GHSA-gcfj-64vw-6mp9","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-gcfj-64vw-6mp9","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-gcfj-64vw-6mp9"},{"rule_id":"osv/GHSA-hfxv-24rg-xrqf","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-hfxv-24rg-xrqf","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-hfxv-24rg-xrqf"},{"rule_id":"osv/GHSA-j5f8-grm9-p9fc","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-j5f8-grm9-p9fc","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-j5f8-grm9-p9fc"},{"rule_id":"osv/GHSA-m8m8-qj5v-23w3","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-m8m8-qj5v-23w3","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-m8m8-qj5v-23w3"},{"rule_id":"osv/GHSA-mghh-pgcx-3jjj","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-mghh-pgcx-3jjj","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-mghh-pgcx-3jjj"},{"rule_id":"osv/GHSA-p92q-9vqr-4j8v","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-p92q-9vqr-4j8v","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-p92q-9vqr-4j8v"},{"rule_id":"osv/GHSA-pjwm-pj3p-43mv","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-pjwm-pj3p-43mv","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-pjwm-pj3p-43mv"},{"rule_id":"osv/GHSA-x97p-jq2g-jp4f","severity":"high","message":"axios@1.15.2 (npm) is affected by GHSA-x97p-jq2g-jp4f","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-x97p-jq2g-jp4f"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.25.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.25.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.25.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.25.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-8r9p-f939-6h3c","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-8r9p-f939-6h3c","path":"package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-8r9p-f939-6h3c"},{"rule_id":"osv/GHSA-mrwp-f3q8-3g9p","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-mrwp-f3q8-3g9p","path":"package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-mrwp-f3q8-3g9p"},{"rule_id":"osv/GHSA-q3jh-wrc6-jgq8","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-q3jh-wrc6-jgq8","path":"package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-q3jh-wrc6-jgq8"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.5 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"package-lock.json","line":null,"fingerprint":"form-data@4.0.5 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@3.14.2 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.2 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@3.14.2 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.2 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@3.14.2 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.2 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.20.1 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"package-lock.json","line":null,"fingerprint":"ws@8.20.1 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-42h9-826w-cgv3","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-42h9-826w-cgv3","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-42h9-826w-cgv3"},{"rule_id":"osv/GHSA-44g4-m2mj-wpvx","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-44g4-m2mj-wpvx","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-44g4-m2mj-wpvx"},{"rule_id":"osv/GHSA-4hqw-qxg8-jxx2","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-4hqw-qxg8-jxx2","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-4hqw-qxg8-jxx2"},{"rule_id":"osv/GHSA-7q8q-rj6j-mhjq","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-7q8q-rj6j-mhjq","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-7q8q-rj6j-mhjq"},{"rule_id":"osv/GHSA-898c-q2cr-xwhg","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-898c-q2cr-xwhg","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-898c-q2cr-xwhg"},{"rule_id":"osv/GHSA-9fr6-4gfg-395g","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-9fr6-4gfg-395g","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-9fr6-4gfg-395g"},{"rule_id":"osv/GHSA-f4gw-2p7v-4548","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-f4gw-2p7v-4548","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-f4gw-2p7v-4548"},{"rule_id":"osv/GHSA-hcpx-6fm6-wx23","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-hcpx-6fm6-wx23","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-hcpx-6fm6-wx23"},{"rule_id":"osv/GHSA-j8rh-479h-cp32","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-j8rh-479h-cp32","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-j8rh-479h-cp32"},{"rule_id":"osv/GHSA-jqh4-m9w3-8hp9","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-jqh4-m9w3-8hp9","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-jqh4-m9w3-8hp9"},{"rule_id":"osv/GHSA-mmx7-hfxf-jppx","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-mmx7-hfxf-jppx","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-mmx7-hfxf-jppx"},{"rule_id":"osv/GHSA-mwf2-3pr3-8698","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-mwf2-3pr3-8698","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-mwf2-3pr3-8698"},{"rule_id":"osv/GHSA-pmv8-rq9r-6j72","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-pmv8-rq9r-6j72","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-pmv8-rq9r-6j72"},{"rule_id":"osv/GHSA-vh66-26gq-q6x8","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-vh66-26gq-q6x8","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-vh66-26gq-q6x8"},{"rule_id":"osv/GHSA-xj6q-8x83-jv6g","severity":"medium","message":"axios@1.15.2 (npm) is affected by GHSA-xj6q-8x83-jv6g","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-xj6q-8x83-jv6g"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.15 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.15 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.1 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.1 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@10.5.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@3.14.2 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.2 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.28.0 (npm) is affected by GHSA-4x5r-pxfx-6jf8","path":"package-lock.json","line":null,"fingerprint":"@babel/core@7.28.0 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-654m-c8p4-x5fp","severity":"low","message":"axios@1.15.2 (npm) is affected by GHSA-654m-c8p4-x5fp","path":"package-lock.json","line":null,"fingerprint":"axios@1.15.2 (npm):GHSA-654m-c8p4-x5fp"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":21.0,"findings_high":14.0,"findings_medium":6.0,"findings_low":1.0,"penalty":162.0},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":55,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":67,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:67"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":70,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:70"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":73,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:73"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":81,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:81"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":95,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:95"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":115,"fingerprint":"unpinned-uses:.github/workflows/build-and-push-to-dockerhub.yml:115"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":32,"fingerprint":"cache-poisoning:.github/workflows/build-and-push-to-dockerhub.yml:32"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":55,"fingerprint":"cache-poisoning:.github/workflows/build-and-push-to-dockerhub.yml:55"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/wipe-history.yml","line":19,"fingerprint":"template-injection:.github/workflows/wipe-history.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/wipe-history.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/wipe-history.yml:21"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":28,"fingerprint":"artipacked:.github/workflows/build-and-push-to-dockerhub.yml:28"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":51,"fingerprint":"artipacked:.github/workflows/build-and-push-to-dockerhub.yml:51"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/build-and-push-to-dockerhub.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":25,"fingerprint":"excessive-permissions:.github/workflows/build-and-push-to-dockerhub.yml:25"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/wipe-history.yml","line":20,"fingerprint":"artipacked:.github/workflows/wipe-history.yml:20"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/wipe-history.yml","line":14,"fingerprint":"excessive-permissions:.github/workflows/wipe-history.yml:14"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/build-and-push-to-dockerhub.yml","line":115,"fingerprint":"superfluous-actions:.github/workflows/build-and-push-to-dockerhub.yml:115"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.1075,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":164.0,"function_nloc":2668.0,"mean_ccn":4.37,"p90_ccn":9.0,"complex_functions":9.0,"long_functions":6.0,"many_param_functions":1.0,"risky_nloc_share":0.3591},"findings":[],"evidence":[{"kind":"complex-function","description":"(anonymous) in src/mattermost-client.ts: complexity 41, 173 lines","ref":"src/mattermost-client.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/mattermost-client.ts#L908","weight":0.6833333333333333},{"kind":"complex-function","description":"handleMessage in src/bridge.ts: complexity 35, 132 lines","ref":"src/bridge.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/bridge.ts#L220","weight":0.5833333333333334},{"kind":"complex-function","description":"loadConfig in src/config.ts: complexity 32, 166 lines","ref":"src/config.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/config.ts#L25","weight":0.5333333333333333},{"kind":"complex-function","description":"handleRightMessage in src/bridge.ts: complexity 28, 116 lines","ref":"src/bridge.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/bridge.ts#L602","weight":0.4666666666666667},{"kind":"complex-function","description":"login in src/mattermost-client.ts: complexity 28, 108 lines","ref":"src/mattermost-client.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/mattermost-client.ts#L108","weight":0.4666666666666667},{"kind":"complex-function","description":"getMessagesSince in src/mattermost-client.ts: complexity 20, 73 lines","ref":"src/mattermost-client.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/mattermost-client.ts#L1443","weight":0.3333333333333333},{"kind":"complex-function","description":"(anonymous) in src/message-attachment.ts: complexity 19, 32 lines","ref":"src/message-attachment.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/message-attachment.ts#L77","weight":0.31666666666666665},{"kind":"complex-function","description":"start in src/bridge.ts: complexity 17, 110 lines","ref":"src/bridge.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/bridge.ts#L60","weight":0.2833333333333333},{"kind":"complex-function","description":"logEventSummary in src/bridge.ts: complexity 17, 48 lines","ref":"src/bridge.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/bridge.ts#L804","weight":0.2833333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":3729.0,"duplicated_lines":154.0,"duplicated_share":0.0413,"files":23.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: build.sh:17 and cleanup-docker.sh:3","ref":"build.sh","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L17","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: build.sh:18 and push-live.sh:16","ref":"build.sh","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/build.sh#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cleanup-docker.sh:1 and scripts/debug-create-channel.sh:1","ref":"cleanup-docker.sh","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/cleanup-docker.sh#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/mattermost-client.ts:438 and src/mattermost-client.ts:620","ref":"src/mattermost-client.ts","url":"https://github.com/cln-io/mattermost-bridge/blob/d212c79eff2291f553e39e5e44a42c63d709e541/src/mattermost-client.ts#L438","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":48.0,"weighted_findings":12.0,"scanned_lines":5192.0,"category:correctness":48.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"build.sh","line":151,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:build.sh:151"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"build.sh","line":161,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:build.sh:161"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"push-live.sh","line":188,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:push-live.sh:188"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":23,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:23"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":28,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:28"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":34,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:34"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":37,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:37"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":43,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:43"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":48,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:48"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/debug-create-channel.sh","line":52,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/debug-create-channel.sh:52"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":52,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:52"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":76,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:76"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":83,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:83"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":85,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:85"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":105,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:105"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":111,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:111"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":129,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:129"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":150,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:150"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":157,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:157"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":176,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:176"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":187,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:187"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":188,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:188"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":195,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:195"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":203,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:203"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":213,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:213"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":219,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:219"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":239,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:239"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":240,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:240"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":246,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:246"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":247,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:247"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":256,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:256"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":257,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:257"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":270,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:270"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":271,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:271"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":274,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:274"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":275,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:275"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":289,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:289"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":294,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:294"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":310,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:310"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":311,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:311"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":314,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:314"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":315,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:315"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":325,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:325"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/local-env-setup.sh","line":332,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/local-env-setup.sh:332"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/mattermost-client.ts","line":885,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/mattermost-client.ts:885"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/mattermost-client.ts","line":885,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/mattermost-client.ts:885"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/mattermost-client.ts","line":885,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/mattermost-client.ts:885"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":2986.0,"source_lines":5192.0,"test_ratio":0.5751,"ci_files":2.0,"cochange_share":0.4062,"cochange_commits":64.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build-and-push-to-dockerhub.yml","ref":".github/workflows/build-and-push-to-dockerhub.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/wipe-history.yml","ref":".github/workflows/wipe-history.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":207.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":60.0,"escapes_per_kloc":16.116},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":361.0,"other_lines":4831.0,"files_blamed":23.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":48.0,"quality:other_per_kloc":9.936,"security:ai_findings":2.0,"security:ai_per_kloc":5.54,"security:other_findings":52.0,"security:other_per_kloc":10.764},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}