{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:03:50.181714Z","repo":{"ref":{"host":"github.com","owner":"cocoindex-io","name":"cocoindex-code"},"default_branch":"main","clone_url":"https://github.com/cocoindex-io/cocoindex-code.git","html_url":"https://github.com/cocoindex-io/cocoindex-code","description":"A super light-weight embedded code search engine CLI (AST based) that just works -  improves speed and efficiency for coding agent  🌟 Star if you like it!","stars":2981,"forks":247,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2805,"primary_language":"Python","license_spdx":"Apache-2.0","created_at":"2026-02-01T02:16:56Z","pushed_at":"2026-11-05T23:36:18Z","security_policy_url":"https://github.com/cocoindex-io/cocoindex-code/security/policy","distribution":{"owner_created_at":"2024-12-06T06:30:59Z","owner_type":"Organization","release_assets":[{"name":"cocoindex_code-0.2.43-py3-none-any.whl","size":96682,"download_count":150,"release_tag":"v0.2.43","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.43/cocoindex_code-0.2.43-py3-none-any.whl"},{"name":"cocoindex_code-0.2.43.tar.gz","size":99476,"download_count":1,"release_tag":"v0.2.43","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.43/cocoindex_code-0.2.43.tar.gz"},{"name":"cocoindex_code-0.2.42-py3-none-any.whl","size":91825,"download_count":12,"release_tag":"v0.2.42","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.42/cocoindex_code-0.2.42-py3-none-any.whl"},{"name":"cocoindex_code-0.2.42.tar.gz","size":94573,"download_count":13,"release_tag":"v0.2.42","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.42/cocoindex_code-0.2.42.tar.gz"},{"name":"cocoindex_code-0.2.41-py3-none-any.whl","size":91439,"download_count":10,"release_tag":"v0.2.41","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.41/cocoindex_code-0.2.41-py3-none-any.whl"},{"name":"cocoindex_code-0.2.41.tar.gz","size":93798,"download_count":9,"release_tag":"v0.2.41","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.41/cocoindex_code-0.2.41.tar.gz"},{"name":"cocoindex_code-0.2.40-py3-none-any.whl","size":90676,"download_count":8,"release_tag":"v0.2.40","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.40/cocoindex_code-0.2.40-py3-none-any.whl"},{"name":"cocoindex_code-0.2.40.tar.gz","size":93029,"download_count":10,"release_tag":"v0.2.40","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.40/cocoindex_code-0.2.40.tar.gz"},{"name":"cocoindex_code-0.2.39-py3-none-any.whl","size":86632,"download_count":6,"release_tag":"v0.2.39","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.39/cocoindex_code-0.2.39-py3-none-any.whl"},{"name":"cocoindex_code-0.2.39.tar.gz","size":88433,"download_count":7,"release_tag":"v0.2.39","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.39/cocoindex_code-0.2.39.tar.gz"},{"name":"cocoindex_code-0.2.38-py3-none-any.whl","size":85778,"download_count":6,"release_tag":"v0.2.38","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.38/cocoindex_code-0.2.38-py3-none-any.whl"},{"name":"cocoindex_code-0.2.38.tar.gz","size":87627,"download_count":6,"release_tag":"v0.2.38","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.38/cocoindex_code-0.2.38.tar.gz"},{"name":"cocoindex_code-0.2.37-py3-none-any.whl","size":78931,"download_count":9,"release_tag":"v0.2.37","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.37/cocoindex_code-0.2.37-py3-none-any.whl"},{"name":"cocoindex_code-0.2.37.tar.gz","size":79546,"download_count":10,"release_tag":"v0.2.37","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.37/cocoindex_code-0.2.37.tar.gz"},{"name":"cocoindex_code-0.2.36-py3-none-any.whl","size":70382,"download_count":6,"release_tag":"v0.2.36","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.36/cocoindex_code-0.2.36-py3-none-any.whl"},{"name":"cocoindex_code-0.2.36.tar.gz","size":71476,"download_count":5,"release_tag":"v0.2.36","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.36/cocoindex_code-0.2.36.tar.gz"},{"name":"cocoindex_code-0.2.35-py3-none-any.whl","size":69408,"download_count":7,"release_tag":"v0.2.35","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.35/cocoindex_code-0.2.35-py3-none-any.whl"},{"name":"cocoindex_code-0.2.35.tar.gz","size":69401,"download_count":7,"release_tag":"v0.2.35","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.35/cocoindex_code-0.2.35.tar.gz"},{"name":"cocoindex_code-0.2.34-py3-none-any.whl","size":67862,"download_count":4,"release_tag":"v0.2.34","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.34/cocoindex_code-0.2.34-py3-none-any.whl"},{"name":"cocoindex_code-0.2.34.tar.gz","size":67851,"download_count":4,"release_tag":"v0.2.34","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.34/cocoindex_code-0.2.34.tar.gz"}]}},"commit_sha":"5676897a169fe1d46cf1e4d2eaf323c9d91c8587","profile":{"lines_by_language":{"Python":14598,"TypeScript":159,"Shell":50},"files_by_category":{"test":31,"source":23,"config":15,"docs":12,"other":1,"binary":1,"generated":1},"source_lines":7124,"test_lines":7683},"pillars":{"ai_provenance":{"score":37.6,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.3756,"suspected_share":0.1417,"estimated_share":0.3756,"ai_artifacts":1.0,"flagged_work_units":1.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 38% of first-party code added; an estimated 38% including velocity signals."},"quality":{"score":75.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":61.7,"duplication":88.8,"lint":40.2,"testing":100.0,"docs":80.0,"type_safety":58.8,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.08, CI runs tests; 16% of function code in complex or long functions; 2% duplicated lines. Weakest area: lint."},"security":{"score":60.6,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":78.6,"dependencies":38.7,"ci_actions":0.9,"posture":60.0,"scorecard":null},"summary":"Security posture is weak: 21 known vulnerabilities in 9 dependencies; 4 high-severity SAST findings; 24 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":18.0,"checked":18.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":242.0,"attributed_commits":72.0,"attributed_commit_share":0.2975206611570248,"effective_loc":19797.0,"attributed_loc":7435.0,"attributed_loc_share":0.3755619538313886,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 72 attributed commits, 7,435 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"5676897a169fe1d46cf1e4d2eaf323c9d91c8587","url":"https://github.com/cocoindex-io/cocoindex-code/commit/5676897a169fe1d46cf1e4d2eaf323c9d91c8587","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"b3834e634c98c526d39d81daa0af2916f45f6616","url":"https://github.com/cocoindex-io/cocoindex-code/commit/b3834e634c98c526d39d81daa0af2916f45f6616","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"b883be0b5d762c9e2d7d82afdedeade5df21d5be","url":"https://github.com/cocoindex-io/cocoindex-code/commit/b883be0b5d762c9e2d7d82afdedeade5df21d5be","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"3aa066e0e7e793443d51b5eed785540a1de3a357","url":"https://github.com/cocoindex-io/cocoindex-code/commit/3aa066e0e7e793443d51b5eed785540a1de3a357","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"fbe3adb1e70ac478ba4f07e7c2a57e456af599d1","url":"https://github.com/cocoindex-io/cocoindex-code/commit/fbe3adb1e70ac478ba4f07e7c2a57e456af599d1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9feb04f867e39b8b08eb200b41f5ee7f09766b90","url":"https://github.com/cocoindex-io/cocoindex-code/commit/9feb04f867e39b8b08eb200b41f5ee7f09766b90","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"519ce97363d04ce33ac9e1e6365ab4592f51e050","url":"https://github.com/cocoindex-io/cocoindex-code/commit/519ce97363d04ce33ac9e1e6365ab4592f51e050","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9fd2e7470a8b042a338dc3cc47fb9940ac5ebb59","url":"https://github.com/cocoindex-io/cocoindex-code/commit/9fd2e7470a8b042a338dc3cc47fb9940ac5ebb59","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"68298cc8d266e6cb3ed4f924a6347ffdecf2bb8f","url":"https://github.com/cocoindex-io/cocoindex-code/commit/68298cc8d266e6cb3ed4f924a6347ffdecf2bb8f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"0c18fe33c3d2780478f0823df812bc525169bc11","url":"https://github.com/cocoindex-io/cocoindex-code/commit/0c18fe33c3d2780478f0823df812bc525169bc11","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"66bbb422fe93cfd4bb2808541c8a10a185ca1911","url":"https://github.com/cocoindex-io/cocoindex-code/commit/66bbb422fe93cfd4bb2808541c8a10a185ca1911","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"fd99851cd5e4d57868e22b4bc750c8887794d408","url":"https://github.com/cocoindex-io/cocoindex-code/commit/fd99851cd5e4d57868e22b4bc750c8887794d408","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"df021fbb683255a2f60d901add41a0652e92ca4f","url":"https://github.com/cocoindex-io/cocoindex-code/commit/df021fbb683255a2f60d901add41a0652e92ca4f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f8411fa6775ed56535cd41571d1b2c8e85269ab7","url":"https://github.com/cocoindex-io/cocoindex-code/commit/f8411fa6775ed56535cd41571d1b2c8e85269ab7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3ce9fb5dc92f202bda14dec07277ec96ee3a61b0","url":"https://github.com/cocoindex-io/cocoindex-code/commit/3ce9fb5dc92f202bda14dec07277ec96ee3a61b0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"f7e0e33b7eaa18823f01b6e59024b3af999aefae","url":"https://github.com/cocoindex-io/cocoindex-code/commit/f7e0e33b7eaa18823f01b6e59024b3af999aefae","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9e357975368c0487fe2d1e763ca80632ba034302","url":"https://github.com/cocoindex-io/cocoindex-code/commit/9e357975368c0487fe2d1e763ca80632ba034302","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"16b76b27899f07c0cbe3846488ae34810d590e71","url":"https://github.com/cocoindex-io/cocoindex-code/commit/16b76b27899f07c0cbe3846488ae34810d590e71","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d91a12d6422c50d9f1c79979fb16efb21db39cb5","url":"https://github.com/cocoindex-io/cocoindex-code/commit/d91a12d6422c50d9f1c79979fb16efb21db39cb5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2e96b45636e6538dd4a374fd8a7283be110998b4","url":"https://github.com/cocoindex-io/cocoindex-code/commit/2e96b45636e6538dd4a374fd8a7283be110998b4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"72f6283a1b8d4aaf4c9a63260194c07162645211","url":"https://github.com/cocoindex-io/cocoindex-code/commit/72f6283a1b8d4aaf4c9a63260194c07162645211","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"17ff8c533c45832f25ea765497ef778b130ccf17","url":"https://github.com/cocoindex-io/cocoindex-code/commit/17ff8c533c45832f25ea765497ef778b130ccf17","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"4372baedfa6bcad0a60533d88f1ae853f9045d0b","url":"https://github.com/cocoindex-io/cocoindex-code/commit/4372baedfa6bcad0a60533d88f1ae853f9045d0b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"a821c20a6422b786787b7e86542645e591c10f0a","url":"https://github.com/cocoindex-io/cocoindex-code/commit/a821c20a6422b786787b7e86542645e591c10f0a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"43d7eb19510fae458e9dde48e34b2b3fb67471a8","url":"https://github.com/cocoindex-io/cocoindex-code/commit/43d7eb19510fae458e9dde48e34b2b3fb67471a8","weight":0.9}],"data":{"attributed_loc_by_commit":{"a77b290314fdfc1c4b1cb8b870826cd2f5d6f4df":0,"ed42d535a2ea312db6afbcd61276c150837320a9":0,"6459fc613654e94ff8ddde876ff51713e3d2297f":120,"f74bce8909b0967ddbf0de54ba5901fae601d3de":25,"56a048d4c92c4fcb96cd91e39f6072ab820f4e3a":181,"0bfc53763ebd93b56b848324cb7d82caabf9825c":13,"f8da74b780ad822e2a9388a441a3d7508d1a3fcc":21,"a979517524c52d45eb6821850b06f014a8428ba4":3,"f0fac4e7e301be307d4f63ab6bf487e496e9bc29":5,"0892c96ae93ec81e4232960ea53e2cbe049e98e3":24,"1b691751e7fb17bfdf892549238d2c1e1c10f979":42,"131bc9b7c7929697f161c222be26e2cd434c7382":10,"326e09ac0155eaba7e05fe744b4434782d4b4923":29,"b67b86142f5968f21574f5cf87fb3df67f39519c":2,"3751a5085394b44613483ca60916faeae8168dc7":0,"8fd7bbdbf6da22e253390e83de3bd33750a4c0be":0,"7fe39b0fd78f519323722b71e6cbb3479556cb35":36,"456e933c587b9169f9e4a92ca4871b0f6f554f73":1,"d3d2afcb07a1c3652b4575dcc7cf4101face6c6e":4,"a665654cfa1c0f12d4fa3474ea9e2ffa562c80dc":5,"c2e6aa9d648dd5af3e86abe642bc5ab94cd81028":2,"f2c8d248df4d0a03d648e96bd792d6bb41ee2b84":0,"6dd5247b8bc13657318d9ba40ad7f6d3f4e96eed":47,"e27bd90553d4197cbaefe0d42c5a2da0427396cb":0,"1c0e6fd5425e33723ae2bcef6cd6acc83c771178":2,"5e831262979804b2445772d0c987d2b8aa5deb5f":0,"0b30f16451a78d08a5ecb108eccaa0a1e07db1e6":713,"f46b977e1fdbd88d355b7c9bd70bf9463002717e":11,"cd4b237cfad20c456cad5d34bcba3447e2514c63":12,"7d9a0dcd3c45fe11259da18b775bdcdf54768012":114,"53d808293f6ba0a7c4f464694a729ffdd082726a":137,"44afda6e9d33719810be95400a6311ff9e5050b4":22,"0237e87b9d82c8e344357fabbc164b8f2028ebe1":5,"e1a66b0009e819294d379974a8e0c7770e201c25":0,"33334bc996ff6389e0c69db824d4e455283ec760":293,"9826fd153e96a7c7565d57a4181f39b162d2233e":52,"a042bdc81074cb7767d14760907cc84b30852765":23,"8bbbc27b9270736fda1555f21f578c794744ad82":0,"c74e2ba0f2e911cadff19b4da744da5581e5a534":0,"21f858e8408a99ed9a417fe389d3e920f6b501cd":69,"49374cf4b52165c762d7d91958bdf06129ab8444":3,"92d611968eef77867ff991e74d7fc7aeab779124":1173,"4b98490aa2f0a6d753ab8342c878920f5174345d":0,"745dcd6875edc5a8c11b64763ad3dd1cfdc363f1":0,"6f84edca2e115d6b4b60918650c2d5701780b975":14,"00ae2d2d6dcc3ff2a97f7d42a7a113de58ee10ce":0,"90d8ff9f08ae5b972e3d512dd46fe934ad3c5de0":0,"43d7eb19510fae458e9dde48e34b2b3fb67471a8":0,"a821c20a6422b786787b7e86542645e591c10f0a":35,"4372baedfa6bcad0a60533d88f1ae853f9045d0b":370,"17ff8c533c45832f25ea765497ef778b130ccf17":0,"72f6283a1b8d4aaf4c9a63260194c07162645211":233,"2e96b45636e6538dd4a374fd8a7283be110998b4":950,"d91a12d6422c50d9f1c79979fb16efb21db39cb5":0,"16b76b27899f07c0cbe3846488ae34810d590e71":0,"9e357975368c0487fe2d1e763ca80632ba034302":0,"f7e0e33b7eaa18823f01b6e59024b3af999aefae":35,"3ce9fb5dc92f202bda14dec07277ec96ee3a61b0":439,"f8411fa6775ed56535cd41571d1b2c8e85269ab7":132,"df021fbb683255a2f60d901add41a0652e92ca4f":654,"fd99851cd5e4d57868e22b4bc750c8887794d408":155,"66bbb422fe93cfd4bb2808541c8a10a185ca1911":43,"0c18fe33c3d2780478f0823df812bc525169bc11":12,"68298cc8d266e6cb3ed4f924a6347ffdecf2bb8f":99,"9fd2e7470a8b042a338dc3cc47fb9940ac5ebb59":245,"519ce97363d04ce33ac9e1e6365ab4592f51e050":360,"9feb04f867e39b8b08eb200b41f5ee7f09766b90":143,"fbe3adb1e70ac478ba4f07e7c2a57e456af599d1":40,"3aa066e0e7e793443d51b5eed785540a1de3a357":64,"b883be0b5d762c9e2d7d82afdedeade5df21d5be":213,"b3834e634c98c526d39d81daa0af2916f45f6616":0,"5676897a169fe1d46cf1e4d2eaf323c9d91c8587":0},"tools":{"claude-code":{"name":"Claude Code","commits":72,"loc":7435,"first_seen":1771544970,"last_seen":1793919716}},"monthly":{"2026-01":{"loc":904,"attributed_loc":0},"2026-02":{"loc":1225,"attributed_loc":572},"2026-03":{"loc":7958,"attributed_loc":1382},"2026-04":{"loc":3417,"attributed_loc":1259},"2026-05":{"loc":41,"attributed_loc":0},"2026-06":{"loc":1600,"attributed_loc":1588},"2026-07":{"loc":1731,"attributed_loc":1458},"2026-08":{"loc":1250,"attributed_loc":356},"2026-09":{"loc":0,"attributed_loc":0},"2026-10":{"loc":1671,"attributed_loc":820},"2026-11":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1773529046.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1773529046}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":118.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":19797.0,"flagged_loc":2805.0,"flagged_loc_share":0.1416881345658433,"max_loc_per_hour":557.5617028325327,"median_loc_per_hour":51.69113472857009,"pr_timed_units":101.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,805 lines of first-party code in ~5.0h (558 lines/hour, PR #67)","ref":"9000f1df7ecd22c57c2d1c4d3956600f30f662a8","url":"https://github.com/cocoindex-io/cocoindex-code/commit/9000f1df7ecd22c57c2d1c4d3956600f30f662a8","weight":0.1672685108497598}],"data":{"flagged_loc_by_commit":{"9000f1df7ecd22c57c2d1c4d3956600f30f662a8":2805},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":49.0,"flagged_releases":0.0,"max_loc_per_day":1865.3},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.0.1","to":"v0.0.2","loc":21,"days":2.01,"loc_per_day":10.4,"flagged":false},{"from":"v0.0.2","to":"v0.1.1","loc":156,"days":0.8,"loc_per_day":194.4,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":21,"days":2.2,"loc_per_day":9.5,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":0,"days":4.01,"loc_per_day":0.0,"flagged":false},{"from":"v0.1.3","to":"v0.1.4","loc":2,"days":5.63,"loc_per_day":0.4,"flagged":false},{"from":"v0.1.4","to":"v0.1.5","loc":2,"days":0.09,"loc_per_day":23.5,"flagged":false},{"from":"v0.1.5","to":"v0.1.6","loc":11,"days":3.28,"loc_per_day":3.4,"flagged":false},{"from":"v0.1.6","to":"v0.1.7","loc":579,"days":5.41,"loc_per_day":107.0,"flagged":false},{"from":"v0.1.7","to":"v0.1.8","loc":346,"days":0.6,"loc_per_day":576.2,"flagged":false},{"from":"v0.1.8","to":"v0.1.9","loc":132,"days":1.61,"loc_per_day":82.0,"flagged":false},{"from":"v0.1.9","to":"v0.1.10","loc":0,"days":2.26,"loc_per_day":0.0,"flagged":false},{"from":"v0.1.10","to":"v0.1.11","loc":27,"days":2.68,"loc_per_day":10.1,"flagged":false},{"from":"v0.1.11","to":"v0.1.12","loc":2,"days":0.76,"loc_per_day":2.6,"flagged":false},{"from":"v0.1.12","to":"v0.1.13","loc":0,"days":1.05,"loc_per_day":0.0,"flagged":false},{"from":"v0.1.13","to":"v0.1.14","loc":167,"days":0.36,"loc_per_day":464.8,"flagged":false},{"from":"v0.1.14","to":"v0.2.0","loc":4628,"days":3.88,"loc_per_day":1194.1,"flagged":false},{"from":"v0.2.0","to":"v0.2.1","loc":328,"days":0.23,"loc_per_day":1437.7,"flagged":false},{"from":"v0.2.1","to":"v0.2.2","loc":23,"days":0.13,"loc_per_day":173.3,"flagged":false},{"from":"v0.2.2","to":"v0.2.3","loc":2,"days":0.35,"loc_per_day":5.7,"flagged":false},{"from":"v0.2.3","to":"v0.2.4","loc":132,"days":1.42,"loc_per_day":93.1,"flagged":false},{"from":"v0.2.4","to":"v0.2.5","loc":683,"days":1.82,"loc_per_day":374.3,"flagged":false},{"from":"v0.2.5","to":"v0.2.6","loc":529,"days":0.3,"loc_per_day":1758.9,"flagged":false},{"from":"v0.2.6","to":"v0.2.7","loc":211,"days":0.55,"loc_per_day":382.5,"flagged":false},{"from":"v0.2.7","to":"v0.2.8","loc":293,"days":0.57,"loc_per_day":513.1,"flagged":false},{"from":"v0.2.8","to":"v0.2.9","loc":439,"days":1.7,"loc_per_day":258.0,"flagged":false},{"from":"v0.2.9","to":"v0.2.10","loc":9,"days":0.92,"loc_per_day":9.8,"flagged":false},{"from":"v0.2.10","to":"v0.2.11","loc":268,"days":12.16,"loc_per_day":22.0,"flagged":false},{"from":"v0.2.11","to":"v0.2.22","loc":72,"days":3.75,"loc_per_day":19.2,"flagged":false},{"from":"v0.2.22","to":"v0.2.23","loc":653,"days":4.39,"loc_per_day":148.8,"flagged":false},{"from":"v0.2.23","to":"v0.2.24","loc":1173,"days":0.63,"loc_per_day":1865.3,"flagged":false},{"from":"v0.2.24","to":"v0.2.25","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.2.25","to":"v0.2.26","loc":14,"days":0.16,"loc_per_day":89.1,"flagged":false},{"from":"v0.2.26","to":"v0.2.27","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.2.27","to":"v0.2.28","loc":7,"days":7.88,"loc_per_day":0.9,"flagged":false},{"from":"v0.2.28","to":"v0.2.29","loc":1135,"days":2.04,"loc_per_day":557.6,"flagged":false},{"from":"v0.2.29","to":"v0.2.30","loc":66,"days":0.73,"loc_per_day":90.9,"flagged":false},{"from":"v0.2.30","to":"v0.2.31","loc":29,"days":1.34,"loc_per_day":21.6,"flagged":false},{"from":"v0.2.31","to":"v0.2.32","loc":2,"days":8.1,"loc_per_day":0.2,"flagged":false},{"from":"v0.2.32","to":"v0.2.33","loc":33,"days":3.55,"loc_per_day":9.3,"flagged":false},{"from":"v0.2.33","to":"v0.2.34","loc":41,"days":26.04,"loc_per_day":1.6,"flagged":false},{"from":"v0.2.34","to":"v0.2.35","loc":370,"days":5.58,"loc_per_day":66.3,"flagged":false},{"from":"v0.2.35","to":"v0.2.36","loc":233,"days":9.9,"loc_per_day":23.5,"flagged":false},{"from":"v0.2.36","to":"v0.2.37","loc":950,"days":3.54,"loc_per_day":268.0,"flagged":false},{"from":"v0.2.37","to":"v0.2.38","loc":1461,"days":25.36,"loc_per_day":57.6,"flagged":false},{"from":"v0.2.38","to":"v0.2.39","loc":155,"days":6.52,"loc_per_day":23.8,"flagged":false},{"from":"v0.2.39","to":"v0.2.40","loc":968,"days":12.62,"loc_per_day":76.7,"flagged":false},{"from":"v0.2.40","to":"v0.2.41","loc":245,"days":0.71,"loc_per_day":343.9,"flagged":false},{"from":"v0.2.41","to":"v0.2.42","loc":164,"days":59.74,"loc_per_day":2.7,"flagged":false},{"from":"v0.2.42","to":"v0.2.43","loc":1671,"days":31.25,"loc_per_day":53.5,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7124.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":6.0,"findings_high":4.0,"findings_medium":2.0,"findings_low":0.0,"weighted_findings":4.9,"scanned_lines":7124.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"docker/Dockerfile","line":82,"fingerprint":"dockerfile.security.missing-user-entrypoint:docker/Dockerfile:82"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/cocoindex_code/client.py","line":564,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/cocoindex_code/client.py:564"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/cocoindex_code/client.py","line":572,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/cocoindex_code/client.py:572"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"src/cocoindex_code/query.py","line":105,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:src/cocoindex_code/query.py:105"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"src/cocoindex_code/_daemon_paths.py","line":57,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:src/cocoindex_code/_daemon_paths.py:57"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"src/cocoindex_code/daemon.py","line":139,"fingerprint":"python.lang.security.audit.non-literal-import:src/cocoindex_code/daemon.py:139"}],"evidence":[],"data":{"rulesets":["python","typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":9.0,"vulnerabilities":21.0,"vulns_critical":1.0,"vulns_high":6.0,"vulns_medium":12.0,"vulns_low":2.0,"vulns_unknown":0.0,"penalty":57.0},"findings":[{"rule_id":"osv/GHSA-6q48-6c7w-9gw2","severity":"critical","message":"certifi@2026.1.4 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2","path":"uv.lock","line":null,"fingerprint":"certifi@2026.1.4 (PyPI):GHSA-6q48-6c7w-9gw2"},{"rule_id":"osv/GHSA-2g87-pp6c-29x5","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-2g87-pp6c-29x5","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-2g87-pp6c-29x5"},{"rule_id":"osv/GHSA-5wr8-gcqf-gqf3","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-5wr8-gcqf-gqf3","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-5wr8-gcqf-gqf3"},{"rule_id":"osv/GHSA-9xw5-w5jj-pvcg","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-9xw5-w5jj-pvcg","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-9xw5-w5jj-pvcg"},{"rule_id":"osv/GHSA-27vj-qcqg-25rc","severity":"high","message":"fsspec@2026.1.0 (PyPI) is affected by PYSEC-2026-4217, GHSA-27vj-qcqg-25rc","path":"uv.lock","line":null,"fingerprint":"fsspec@2026.1.0 (PyPI):GHSA-27vj-qcqg-25rc"},{"rule_id":"osv/GHSA-g5ff-637f-6q2m","severity":"high","message":"litellm@1.88.6 (PyPI) is affected by GHSA-g5ff-637f-6q2m","path":"uv.lock","line":null,"fingerprint":"litellm@1.88.6 (PyPI):GHSA-g5ff-637f-6q2m"},{"rule_id":"osv/GHSA-84m7-p3x7-pcfv","severity":"high","message":"mcp@2.0.0 (PyPI) is affected by GHSA-84m7-p3x7-pcfv","path":"uv.lock","line":null,"fingerprint":"mcp@2.0.0 (PyPI):GHSA-84m7-p3x7-pcfv"},{"rule_id":"osv/GHSA-494j-54xm-rwp3","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-494j-54xm-rwp3","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-494j-54xm-rwp3"},{"rule_id":"osv/GHSA-6cjc-53gc-5rqm","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-6cjc-53gc-5rqm","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-6cjc-53gc-5rqm"},{"rule_id":"osv/GHSA-f9xw-jh8m-3mwq","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-f9xw-jh8m-3mwq","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-f9xw-jh8m-3mwq"},{"rule_id":"osv/GHSA-pqxq-w44r-73xw","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-pqxq-w44r-73xw","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-pqxq-w44r-73xw"},{"rule_id":"osv/GHSA-69hj-f68j-2879","severity":"medium","message":"filelock@3.20.3 (PyPI) is affected by GHSA-69hj-f68j-2879","path":"uv.lock","line":null,"fingerprint":"filelock@3.20.3 (PyPI):GHSA-69hj-f68j-2879"},{"rule_id":"osv/GHSA-8mx5-7m5m-r77g","severity":"medium","message":"filelock@3.20.3 (PyPI) is affected by GHSA-8mx5-7m5m-r77g","path":"uv.lock","line":null,"fingerprint":"filelock@3.20.3 (PyPI):GHSA-8mx5-7m5m-r77g"},{"rule_id":"osv/GHSA-5h93-6whr-6q8j","severity":"medium","message":"mcp@2.0.0 (PyPI) is affected by GHSA-5h93-6whr-6q8j","path":"uv.lock","line":null,"fingerprint":"mcp@2.0.0 (PyPI):GHSA-5h93-6whr-6q8j"},{"rule_id":"osv/GHSA-rwrf-2pqf-9j8j","severity":"medium","message":"mcp@2.0.0 (PyPI) is affected by GHSA-rwrf-2pqf-9j8j","path":"uv.lock","line":null,"fingerprint":"mcp@2.0.0 (PyPI):GHSA-rwrf-2pqf-9j8j"},{"rule_id":"osv/GHSA-w4fh-qvv9-3v23","severity":"medium","message":"mcp@2.0.0 (PyPI) is affected by GHSA-w4fh-qvv9-3v23","path":"uv.lock","line":null,"fingerprint":"mcp@2.0.0 (PyPI):GHSA-w4fh-qvv9-3v23"},{"rule_id":"osv/GHSA-54p9-h82j-f925","severity":"medium","message":"multidict@6.7.1 (PyPI) is affected by PYSEC-2026-4244, GHSA-54p9-h82j-f925","path":"uv.lock","line":null,"fingerprint":"multidict@6.7.1 (PyPI):GHSA-54p9-h82j-f925"},{"rule_id":"osv/GHSA-mf5v-w3w3-f6cg","severity":"medium","message":"opentelemetry-api@1.44.0 (PyPI) is affected by GHSA-mf5v-w3w3-f6cg","path":"uv.lock","line":null,"fingerprint":"opentelemetry-api@1.44.0 (PyPI):GHSA-mf5v-w3w3-f6cg"},{"rule_id":"osv/GHSA-xcq7-p3pf-p88h","severity":"medium","message":"opentelemetry-api@1.44.0 (PyPI) is affected by GHSA-xcq7-p3pf-p88h","path":"uv.lock","line":null,"fingerprint":"opentelemetry-api@1.44.0 (PyPI):GHSA-xcq7-p3pf-p88h"},{"rule_id":"osv/GHSA-gx76-c99x-2c96","severity":"low","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-gx76-c99x-2c96","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-gx76-c99x-2c96"},{"rule_id":"osv/GHSA-xmj3-9gf7-h52w","severity":"low","message":"setuptools@83.0.0 (PyPI) is affected by GHSA-xmj3-9gf7-h52w","path":"uv.lock","line":null,"fingerprint":"setuptools@83.0.0 (PyPI):GHSA-xmj3-9gf7-h52w"}],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":29.0,"findings_high":24.0,"findings_medium":5.0,"findings_low":0.0,"penalty":285.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pre-commit.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/pre-commit.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pre-commit.yml","line":53,"fingerprint":"unpinned-uses:.github/workflows/pre-commit.yml:53"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pre-commit.yml","line":56,"fingerprint":"unpinned-uses:.github/workflows/pre-commit.yml:56"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pre-commit.yml","line":92,"fingerprint":"unpinned-uses:.github/workflows/pre-commit.yml:92"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pre-commit.yml","line":95,"fingerprint":"unpinned-uses:.github/workflows/pre-commit.yml:95"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":116,"fingerprint":"template-injection:.github/workflows/release.yml:116"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":297,"fingerprint":"template-injection:.github/workflows/release.yml:297"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/release.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/release.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":42,"fingerprint":"unpinned-uses:.github/workflows/release.yml:42"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":48,"fingerprint":"unpinned-uses:.github/workflows/release.yml:48"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":66,"fingerprint":"unpinned-uses:.github/workflows/release.yml:66"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":72,"fingerprint":"unpinned-uses:.github/workflows/release.yml:72"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":89,"fingerprint":"unpinned-uses:.github/workflows/release.yml:89"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":95,"fingerprint":"unpinned-uses:.github/workflows/release.yml:95"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":106,"fingerprint":"unpinned-uses:.github/workflows/release.yml:106"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":152,"fingerprint":"unpinned-uses:.github/workflows/release.yml:152"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":255,"fingerprint":"unpinned-uses:.github/workflows/release.yml:255"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":259,"fingerprint":"unpinned-uses:.github/workflows/release.yml:259"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":264,"fingerprint":"unpinned-uses:.github/workflows/release.yml:264"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":267,"fingerprint":"unpinned-uses:.github/workflows/release.yml:267"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":274,"fingerprint":"unpinned-uses:.github/workflows/release.yml:274"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":322,"fingerprint":"unpinned-uses:.github/workflows/release.yml:322"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":42,"fingerprint":"cache-poisoning:.github/workflows/release.yml:42"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/pre-commit.yml","line":53,"fingerprint":"artipacked:.github/workflows/pre-commit.yml:53"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/pre-commit.yml","line":92,"fingerprint":"artipacked:.github/workflows/pre-commit.yml:92"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":32,"fingerprint":"artipacked:.github/workflows/release.yml:32"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":152,"fingerprint":"artipacked:.github/workflows/release.yml:152"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":255,"fingerprint":"artipacked:.github/workflows/release.yml:255"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.98,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":10.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.2.43 ships cocoindex_code-0.2.43.tar.gz (1 downloads)","ref":"cocoindex_code-0.2.43.tar.gz","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.43/cocoindex_code-0.2.43.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.2.42 ships cocoindex_code-0.2.42.tar.gz (13 downloads)","ref":"cocoindex_code-0.2.42.tar.gz","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.42/cocoindex_code-0.2.42.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.2.41 ships cocoindex_code-0.2.41.tar.gz (9 downloads)","ref":"cocoindex_code-0.2.41.tar.gz","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.41/cocoindex_code-0.2.41.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.2.40 ships cocoindex_code-0.2.40.tar.gz (10 downloads)","ref":"cocoindex_code-0.2.40.tar.gz","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.40/cocoindex_code-0.2.40.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.2.39 ships cocoindex_code-0.2.39.tar.gz (7 downloads)","ref":"cocoindex_code-0.2.39.tar.gz","url":"https://github.com/cocoindex-io/cocoindex-code/releases/download/v0.2.39/cocoindex_code-0.2.39.tar.gz","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":259.0,"function_nloc":3710.0,"mean_ccn":3.8,"p90_ccn":8.0,"complex_functions":6.0,"long_functions":3.0,"many_param_functions":1.0,"risky_nloc_share":0.1609},"findings":[],"evidence":[{"kind":"complex-function","description":"main in src/cocoindex_code/server.py: complexity 25, 112 lines","ref":"src/cocoindex_code/server.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/server.py#L233","weight":0.4166666666666667},{"kind":"complex-function","description":"doctor in src/cocoindex_code/cli.py: complexity 23, 95 lines","ref":"src/cocoindex_code/cli.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/cli.py#L932","weight":0.38333333333333336},{"kind":"complex-function","description":"reset in src/cocoindex_code/cli.py: complexity 19, 57 lines","ref":"src/cocoindex_code/cli.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/cli.py#L815","weight":0.31666666666666665},{"kind":"complex-function","description":"main in scripts/find_best_models.py: complexity 17, 191 lines","ref":"scripts/find_best_models.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/scripts/find_best_models.py#L153","weight":0.2833333333333333},{"kind":"complex-function","description":"run_daemon in src/cocoindex_code/daemon.py: complexity 16, 110 lines","ref":"src/cocoindex_code/daemon.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/daemon.py#L714","weight":0.26666666666666666},{"kind":"complex-function","description":"_user_settings_from_dict in src/cocoindex_code/settings.py: complexity 16, 32 lines","ref":"src/cocoindex_code/settings.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/settings.py#L532","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5251.0,"duplicated_lines":104.0,"duplicated_share":0.0198,"files":23.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/cli.py:315 and src/cocoindex_code/client.py:422","ref":"src/cocoindex_code/cli.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/cli.py#L315","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/cli.py:1063 and src/cocoindex_code/server.py:397","ref":"src/cocoindex_code/cli.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/cli.py#L1063","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/client.py:54 and src/cocoindex_code/daemon.py:60","ref":"src/cocoindex_code/client.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/client.py#L54","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/client.py:383 and src/cocoindex_code/client.py:436","ref":"src/cocoindex_code/client.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/client.py#L383","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/daemon.py:361 and src/cocoindex_code/daemon.py:570","ref":"src/cocoindex_code/daemon.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/daemon.py#L361","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/project.py:250 and src/cocoindex_code/server.py:155","ref":"src/cocoindex_code/project.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/project.py#L250","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/protocol.py:132 and src/cocoindex_code/schema.py:24","ref":"src/cocoindex_code/protocol.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/protocol.py#L132","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/cocoindex_code/schema.py:11 and src/cocoindex_code/shared.py:190","ref":"src/cocoindex_code/schema.py","url":"https://github.com/cocoindex-io/cocoindex-code/blob/5676897a169fe1d46cf1e4d2eaf323c9d91c8587/src/cocoindex_code/schema.py#L11","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":14.0,"weighted_findings":26.0,"scanned_lines":7124.0,"category:best-practice":10.0,"category:correctness":1.0,"category:maintainability":3.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/cocoindex_code/cli.py","line":1145,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/cocoindex_code/cli.py:1145"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/cocoindex_code/client.py","line":200,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/cocoindex_code/client.py:200"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/cocoindex_code/client.py","line":626,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/cocoindex_code/client.py:626"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/cocoindex_code/client.py","line":750,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/cocoindex_code/client.py:750"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.identical-is-comparison","severity":"high","message":"Found identical comparison using is. Ensure this is what you intended.","path":"src/cocoindex_code/daemon.py","line":823,"fingerprint":"python.lang.correctness.common-mistakes.identical-is-comparison:src/cocoindex_code/daemon.py:823"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `search` is defined inside a function but never used","path":"src/cocoindex_code/server.py","line":73,"fingerprint":"python.lang.maintainability.useless-inner-function:src/cocoindex_code/server.py:73"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/find_best_models.py","line":389,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/find_best_models.py:389"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/cocoindex_code/client.py","line":561,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/cocoindex_code/client.py:561"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"src/cocoindex_code/settings.py","line":158,"fingerprint":"python.lang.maintainability.return-not-in-function:src/cocoindex_code/settings.py:158"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"src/cocoindex_code/settings.py","line":159,"fingerprint":"python.lang.maintainability.return-not-in-function:src/cocoindex_code/settings.py:159"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/cocoindex_code/settings.py","line":661,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/cocoindex_code/settings.py:661"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/cocoindex_code/settings.py","line":674,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/cocoindex_code/settings.py:674"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/cocoindex_code/settings.py","line":769,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/cocoindex_code/settings.py:769"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"src/cocoindex_code/settings.py","line":782,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:src/cocoindex_code/settings.py:782"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":7683.0,"source_lines":7124.0,"test_ratio":1.0785,"ci_files":2.0,"cochange_share":0.6103,"cochange_commits":136.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/pre-commit.yml","ref":".github/workflows/pre-commit.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (pre-commit)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest"],"lint_commands":["pre-commit"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":742.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.9794,"check:low_escape_density":0.0,"escapes":69.0,"escapes_per_kloc":9.754},"findings":[],"evidence":[{"kind":"typing","description":"Python strict type checking: pyproject.toml","ref":"pyproject.toml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2677.0,"other_lines":4447.0,"files_blamed":23.0,"blame_failures":0.0,"quality:ai_findings":3.0,"quality:ai_per_kloc":1.121,"quality:other_findings":11.0,"quality:other_per_kloc":2.474,"quality:ratio":0.45,"security:ai_findings":1.0,"security:ai_per_kloc":0.374,"security:other_findings":4.0,"security:other_per_kloc":0.899,"security:ratio":0.42},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}