{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:03.891281Z","repo":{"ref":{"host":"github.com","owner":"dekub100","name":"sc-sp-remote"},"default_branch":"main","clone_url":"https://github.com/dekub100/sc-sp-remote.git","html_url":"https://github.com/dekub100/sc-sp-remote","description":"Remotely control Spotify and SoundCloud via WebSockets without Spotify Premium — includes a web interface, OBS widget, and Stream Deck plugin.","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2039,"primary_language":"Python","license_spdx":"MIT","created_at":"2025-08-05T16:54:33Z","pushed_at":"2026-11-11T13:29:02Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-10-06T11:18:20Z","owner_type":"User","release_assets":[{"name":"com.dekub.sc-sp-remote.streamDeckPlugin","size":228200,"download_count":3,"release_tag":"v3.0.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v3.0.0/com.dekub.sc-sp-remote.streamDeckPlugin"},{"name":"sc-sp-remote-core-v3.0.0.zip","size":78316,"download_count":6,"release_tag":"v3.0.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v3.0.0/sc-sp-remote-core-v3.0.0.zip"},{"name":"com.dekub.sc-sp-remote.streamDeckPlugin","size":228247,"download_count":1,"release_tag":"v2.3.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.3.0/com.dekub.sc-sp-remote.streamDeckPlugin"},{"name":"sc-sp-remote-core-v2.3.0.zip","size":64920,"download_count":3,"release_tag":"v2.3.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.3.0/sc-sp-remote-core-v2.3.0.zip"},{"name":"com.dekub.sc-sp-remote.streamDeckPlugin","size":228247,"download_count":2,"release_tag":"v2.2.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.2.0/com.dekub.sc-sp-remote.streamDeckPlugin"},{"name":"sc-sp-remote-core-v2.2.0.zip","size":64036,"download_count":3,"release_tag":"v2.2.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.2.0/sc-sp-remote-core-v2.2.0.zip"},{"name":"com.dekub.sc-sp-remote.streamDeckPlugin","size":231135,"download_count":1,"release_tag":"v2.1.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.1.0/com.dekub.sc-sp-remote.streamDeckPlugin"},{"name":"sc-sp-remote-core-v2.1.0.zip","size":63604,"download_count":2,"release_tag":"v2.1.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.1.0/sc-sp-remote-core-v2.1.0.zip"},{"name":"com.dekub.sc-sp-remote.streamDeckPlugin","size":230367,"download_count":1,"release_tag":"v2.0.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.0.0/com.dekub.sc-sp-remote.streamDeckPlugin"},{"name":"sc-sp-remote-core-v2.0.0.zip","size":53285,"download_count":4,"release_tag":"v2.0.0","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.0.0/sc-sp-remote-core-v2.0.0.zip"},{"name":"com.dekub.spicetify-remote.streamDeckPlugin","size":215553,"download_count":1,"release_tag":"v1.5.5","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.5/com.dekub.spicetify-remote.streamDeckPlugin"},{"name":"spicetify-remote-core-v1.5.5.zip","size":49447,"download_count":2,"release_tag":"v1.5.5","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.5/spicetify-remote-core-v1.5.5.zip"},{"name":"com.dekub.spicetify-remote.streamDeckPlugin","size":215574,"download_count":2,"release_tag":"v1.5.4","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.4/com.dekub.spicetify-remote.streamDeckPlugin"},{"name":"spicetify-remote-core-v1.5.4.zip","size":50489,"download_count":3,"release_tag":"v1.5.4","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.4/spicetify-remote-core-v1.5.4.zip"},{"name":"com.dekub.spicetify-remote.streamDeckPlugin","size":215457,"download_count":1,"release_tag":"v1.5.3","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.3/com.dekub.spicetify-remote.streamDeckPlugin"},{"name":"spicetify-remote-core-v1.5.3.zip","size":53488,"download_count":2,"release_tag":"v1.5.3","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.3/spicetify-remote-core-v1.5.3.zip"},{"name":"com.dekub.spicetify-remote.streamDeckPlugin","size":215457,"download_count":1,"release_tag":"v1.5.2","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.2/com.dekub.spicetify-remote.streamDeckPlugin"},{"name":"spicetify-remote-core-v1.5.2.zip","size":48949,"download_count":2,"release_tag":"v1.5.2","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.2/spicetify-remote-core-v1.5.2.zip"},{"name":"com.dekub.spicetify-remote.streamDeckPlugin","size":215430,"download_count":1,"release_tag":"v1.5.1","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.1/com.dekub.spicetify-remote.streamDeckPlugin"},{"name":"spicetify-remote-core-v1.5.1.zip","size":48409,"download_count":2,"release_tag":"v1.5.1","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v1.5.1/spicetify-remote-core-v1.5.1.zip"}]}},"commit_sha":"3e2d754190d45d2abe51a23162c981c94d3e5702","profile":{"lines_by_language":{"Python":5859,"JavaScript":2759,"TypeScript":808},"files_by_category":{"source":38,"other":26,"test":16,"docs":15,"config":9,"binary":4,"generated":1},"source_lines":6649,"test_lines":2777},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.2786,"estimated_share":0.0,"ai_artifacts":1.0,"flagged_work_units":3.0,"flagged_releases":0.0,"style_index":0.752},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":69.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":52.5,"duplication":84.5,"lint":46.7,"testing":95.9,"docs":80.0,"type_safety":0.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.42, CI runs tests; 21% of function code in complex or long functions; 3% duplicated lines. Weakest area: type safety."},"security":{"score":48.3,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":47.9,"dependencies":40.7,"ci_actions":5.4,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 73 known vulnerabilities in 8 dependencies; 17 high-severity SAST findings; 17 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":19.0,"checked":19.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":165.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":25064.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2025-08":{"loc":1196,"attributed_loc":0},"2025-09":{"loc":119,"attributed_loc":0},"2025-10":{"loc":183,"attributed_loc":0},"2025-11":{"loc":1139,"attributed_loc":0},"2025-12":{"loc":613,"attributed_loc":0},"2026-01":{"loc":4,"attributed_loc":0},"2026-03":{"loc":1881,"attributed_loc":0},"2026-05":{"loc":7511,"attributed_loc":0},"2026-06":{"loc":3671,"attributed_loc":0},"2026-08":{"loc":1846,"attributed_loc":0},"2026-10":{"loc":598,"attributed_loc":0},"2026-11":{"loc":6303,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1779046323.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1779046323}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":52.0,"flagged_units":3.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":25064.0,"flagged_loc":6984.0,"flagged_loc_share":0.27864666453878073,"max_loc_per_hour":1934.539732494099,"median_loc_per_hour":119.87585671796198,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,415 lines of first-party code in ~1.8h (1,935 lines/hour, 9 commit session)","ref":"3e2d754190d45d2abe51a23162c981c94d3e5702","url":"https://github.com/dekub100/sc-sp-remote/commit/3e2d754190d45d2abe51a23162c981c94d3e5702","weight":0.5803619197482297},{"kind":"velocity-burst","description":"2,093 lines of first-party code in ~1.9h (1,091 lines/hour, 3 commit session)","ref":"4078e21949335c999efbf8321048599b9d333941","url":"https://github.com/dekub100/sc-sp-remote/commit/4078e21949335c999efbf8321048599b9d333941","weight":0.3272206137811233},{"kind":"velocity-burst","description":"1,476 lines of first-party code in ~1.7h (871 lines/hour, 2 commit session)","ref":"65006cf819403b5d58107c86018be7557e7c8dbf","url":"https://github.com/dekub100/sc-sp-remote/commit/65006cf819403b5d58107c86018be7557e7c8dbf","weight":0.2612817570890018}],"data":{"flagged_loc_by_commit":{"db079427a7d53d158692b379a6212d7afdd9d107":1370,"65006cf819403b5d58107c86018be7557e7c8dbf":106,"dd366d2721524230445d66b664974cc33fed60ea":136,"fd2a3926199e2d7e7f963d0bda950518844f05df":520,"4078e21949335c999efbf8321048599b9d333941":1437,"c41487898666687b5339cc9b92c4d7835c4a56b2":430,"9d723ce9133e2969121df19672ee960afeb045f5":120,"699f3110365f6b9f31461d18b5581f9ce5f95555":90,"b621783b783cb21168d9f87a965ed02292b26d7e":69,"48d67b32a652e906b861af73f285e196dd02272b":4,"b2e8f8cdf1d991441fa9b67b3d79c57117cc3aa1":2687,"3933722ef947913bd431628ad02e35e9bb999722":1,"4009a4b398d0df07d543f6d3127141af5b128d1d":2,"3e2d754190d45d2abe51a23162c981c94d3e5702":12},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":16.0,"flagged_releases":0.0,"max_loc_per_day":20902.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0.0","to":"v1.0.1","loc":1,"days":5.04,"loc_per_day":0.2,"flagged":false},{"from":"v1.0.1","to":"v1.1.0","loc":354,"days":46.84,"loc_per_day":7.6,"flagged":false},{"from":"v1.1.0","to":"v1.2.0","loc":35,"days":0.09,"loc_per_day":371.7,"flagged":false},{"from":"v1.2.0","to":"v1.3.0","loc":1476,"days":0.07,"loc_per_day":20902.5,"flagged":false},{"from":"v1.3.0","to":"v1.4.0","loc":743,"days":0.76,"loc_per_day":971.7,"flagged":false},{"from":"v1.4.0","to":"v1.4.2","loc":478,"days":0.26,"loc_per_day":1828.9,"flagged":false},{"from":"v1.4.2","to":"v1.5.0","loc":980,"days":0.85,"loc_per_day":1149.9,"flagged":false},{"from":"v1.5.0","to":"v1.5.1","loc":454,"days":0.08,"loc_per_day":5710.5,"flagged":false},{"from":"v1.5.1","to":"v1.5.2","loc":278,"days":0.82,"loc_per_day":340.2,"flagged":false},{"from":"v1.5.2","to":"v1.5.3","loc":917,"days":4.15,"loc_per_day":221.0,"flagged":false},{"from":"v1.5.3","to":"v1.5.4","loc":449,"days":6.87,"loc_per_day":65.4,"flagged":false},{"from":"v1.5.4","to":"v2.0.0","loc":5018,"days":8.0,"loc_per_day":627.3,"flagged":false},{"from":"v2.0.0","to":"v2.1.0","loc":1480,"days":76.26,"loc_per_day":19.4,"flagged":false},{"from":"v2.1.0","to":"v2.2.0","loc":363,"days":0.89,"loc_per_day":406.6,"flagged":false},{"from":"v2.2.0","to":"v2.3.0","loc":601,"days":46.87,"loc_per_day":12.8,"flagged":false},{"from":"v2.3.0","to":"v3.0.0","loc":6291,"days":31.91,"loc_per_day":197.1,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":6649.0,"index":0.752,"count:narrated_steps":5.0,"per_kloc:narrated_steps":0.752,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Dispatch mouseover + mousemove to trigger SoundCloud's","ref":"soundcloud-plugin/soundcloud-remote-bridge.js:305","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/soundcloud-plugin/soundcloud-remote-bridge.js#L305","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Poll until .volume.expanded.hover exists.","ref":"soundcloud-plugin/soundcloud-remote-bridge.js:311","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/soundcloud-plugin/soundcloud-remote-bridge.js#L311","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Calculate Y position.","ref":"soundcloud-plugin/soundcloud-remote-bridge.js:334","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/soundcloud-plugin/soundcloud-remote-bridge.js#L334","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 4: Simulate the click on the slider track.","ref":"soundcloud-plugin/soundcloud-remote-bridge.js:345","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/soundcloud-plugin/soundcloud-remote-bridge.js#L345","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 5: Mouse out to dismiss the slider.","ref":"soundcloud-plugin/soundcloud-remote-bridge.js:349","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/soundcloud-plugin/soundcloud-remote-bridge.js#L349","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":22.0,"findings_high":17.0,"findings_medium":5.0,"findings_low":0.0,"weighted_findings":14.0,"scanned_lines":6649.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"manage.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:manage.py:106"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"manage.py","line":120,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:manage.py:120"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"manage.py","line":149,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:manage.py:149"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"manage.py","line":231,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:manage.py:231"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"manage.py","line":403,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:manage.py:403"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"manage.py","line":419,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:manage.py:419"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"server/lyrics.py","line":320,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:server/lyrics.py:320"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"spicetify-extension/remoteVolume.js","line":116,"fingerprint":"javascript.lang.security.detect-insecure-websocket:spicetify-extension/remoteVolume.js:116"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"spicetify-extension/remoteVolume.js","line":144,"fingerprint":"javascript.lang.security.detect-insecure-websocket:spicetify-extension/remoteVolume.js:144"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/obs-widget/obs-script.js","line":119,"fingerprint":"javascript.browser.security.insecure-document-method:web/obs-widget/obs-script.js:119"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/obs-widget/obs-script.js","line":119,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/obs-widget/obs-script.js:119"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/script.js","line":173,"fingerprint":"javascript.browser.security.insecure-document-method:web/script.js:173"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ui.lyricsContent.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/script.js","line":173,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/script.js:173"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/script.js","line":179,"fingerprint":"javascript.browser.security.insecure-document-method:web/script.js:179"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ui.lyricsContent.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/script.js","line":179,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/script.js:179"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/script.js","line":183,"fingerprint":"javascript.browser.security.insecure-document-method:web/script.js:183"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ui.lyricsContent.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/script.js","line":183,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/script.js:183"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"manage.py","line":336,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:manage.py:336"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"server/lyrics.py","line":320,"fingerprint":"python.lang.security.audit.formatted-sql-query:server/lyrics.py:320"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/obs-widget/obs-script.js","line":151,"fingerprint":"javascript.lang.security.html-in-template-string:web/obs-widget/obs-script.js:151"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/script.js","line":180,"fingerprint":"javascript.lang.security.html-in-template-string:web/script.js:180"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/script.js","line":183,"fingerprint":"javascript.lang.security.html-in-template-string:web/script.js:183"}],"evidence":[],"data":{"rulesets":["python","javascript","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":8.0,"vulnerabilities":73.0,"vulns_critical":1.0,"vulns_high":34.0,"vulns_medium":29.0,"vulns_low":9.0,"vulns_unknown":0.0,"penalty":54.0},"findings":[{"rule_id":"osv/GHSA-63hf-3vf5-4wqf","severity":"critical","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2102, GHSA-63hf-3vf5-4wqf; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-63hf-3vf5-4wqf"},{"rule_id":"osv/GHSA-6mq8-rvhq-8wgg","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1101, GHSA-6mq8-rvhq-8wgg; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-6mq8-rvhq-8wgg"},{"rule_id":"osv/GHSA-hcc4-c3v8-rx92","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2095, GHSA-hcc4-c3v8-rx92; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-hcc4-c3v8-rx92"},{"rule_id":"osv/GHSA-p998-jp59-783m","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2097, GHSA-p998-jp59-783m; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-p998-jp59-783m"},{"rule_id":"osv/GHSA-m5qp-6w8w-w647","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2098, GHSA-m5qp-6w8w-w647; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-m5qp-6w8w-w647"},{"rule_id":"osv/GHSA-jg22-mg44-37j8","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2104, GHSA-jg22-mg44-37j8; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-jg22-mg44-37j8"},{"rule_id":"osv/GHSA-hg6j-4rv6-33pg","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2105, GHSA-hg6j-4rv6-33pg; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-hg6j-4rv6-33pg"},{"rule_id":"osv/GHSA-m6qw-4cw2-hm4m","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2106, GHSA-m6qw-4cw2-hm4m; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-m6qw-4cw2-hm4m"},{"rule_id":"osv/GHSA-4fvr-rgm6-gqmc","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2107, GHSA-4fvr-rgm6-gqmc; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-4fvr-rgm6-gqmc"},{"rule_id":"osv/GHSA-xcgm-r5h9-7989","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2108, GHSA-xcgm-r5h9-7989; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-xcgm-r5h9-7989"},{"rule_id":"osv/GHSA-63hw-fmq6-xxg2","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2110, GHSA-63hw-fmq6-xxg2; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-63hw-fmq6-xxg2"},{"rule_id":"osv/GHSA-g3cq-j2xw-wf74","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2111, GHSA-g3cq-j2xw-wf74; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-g3cq-j2xw-wf74"},{"rule_id":"osv/GHSA-2fqr-mr3j-6wp8","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2112, GHSA-2fqr-mr3j-6wp8; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-2fqr-mr3j-6wp8"},{"rule_id":"osv/GHSA-9x8q-7h8h-wcw9","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2113, GHSA-9x8q-7h8h-wcw9; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-9x8q-7h8h-wcw9"},{"rule_id":"osv/GHSA-4m7w-qmgq-4wj5","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-237, GHSA-4m7w-qmgq-4wj5; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-4m7w-qmgq-4wj5"},{"rule_id":"osv/GHSA-cq5v-8q36-5273","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-3545, GHSA-cq5v-8q36-5273; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-cq5v-8q36-5273"},{"rule_id":"osv/GHSA-2g87-pp6c-29x5","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by GHSA-2g87-pp6c-29x5; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-2g87-pp6c-29x5"},{"rule_id":"osv/GHSA-5wr8-gcqf-gqf3","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by GHSA-5wr8-gcqf-gqf3; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-5wr8-gcqf-gqf3"},{"rule_id":"osv/GHSA-9xw5-w5jj-pvcg","severity":"high","message":"aiohttp@3.13 (PyPI) is affected by GHSA-9xw5-w5jj-pvcg; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-9xw5-w5jj-pvcg"},{"rule_id":"osv/GHSA-4fvr-rgm6-gqmc","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-2107, GHSA-4fvr-rgm6-gqmc; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-4fvr-rgm6-gqmc"},{"rule_id":"osv/GHSA-xcgm-r5h9-7989","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-2108, GHSA-xcgm-r5h9-7989; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-xcgm-r5h9-7989"},{"rule_id":"osv/GHSA-63hw-fmq6-xxg2","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-2110, GHSA-63hw-fmq6-xxg2; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-63hw-fmq6-xxg2"},{"rule_id":"osv/GHSA-g3cq-j2xw-wf74","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-2111, GHSA-g3cq-j2xw-wf74; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-g3cq-j2xw-wf74"},{"rule_id":"osv/GHSA-2fqr-mr3j-6wp8","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-2112, GHSA-2fqr-mr3j-6wp8; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-2fqr-mr3j-6wp8"},{"rule_id":"osv/GHSA-9x8q-7h8h-wcw9","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-2113, GHSA-9x8q-7h8h-wcw9; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-9x8q-7h8h-wcw9"},{"rule_id":"osv/GHSA-4m7w-qmgq-4wj5","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-237, GHSA-4m7w-qmgq-4wj5; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-4m7w-qmgq-4wj5"},{"rule_id":"osv/GHSA-cq5v-8q36-5273","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-3545, GHSA-cq5v-8q36-5273; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-cq5v-8q36-5273"},{"rule_id":"osv/GHSA-2g87-pp6c-29x5","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by GHSA-2g87-pp6c-29x5; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-2g87-pp6c-29x5"},{"rule_id":"osv/GHSA-5wr8-gcqf-gqf3","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by GHSA-5wr8-gcqf-gqf3; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-5wr8-gcqf-gqf3"},{"rule_id":"osv/GHSA-9xw5-w5jj-pvcg","severity":"high","message":"aiohttp@3.14 (PyPI) is affected by GHSA-9xw5-w5jj-pvcg; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-9xw5-w5jj-pvcg"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-58mr-gqgx-xq4g","severity":"high","message":"fast-uri@3.1.6 (npm) is affected by GHSA-58mr-gqgx-xq4g","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-58mr-gqgx-xq4g"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.6 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-6jhg-hg63-jvvf","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1100, GHSA-6jhg-hg63-jvvf; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-6jhg-hg63-jvvf"},{"rule_id":"osv/GHSA-g84x-mcqj-x9qq","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1106, GHSA-g84x-mcqj-x9qq; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-g84x-mcqj-x9qq"},{"rule_id":"osv/GHSA-jj3x-wxrx-4x23","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1107, GHSA-jj3x-wxrx-4x23; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-jj3x-wxrx-4x23"},{"rule_id":"osv/GHSA-w2fm-2cpv-w7v5","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2094, GHSA-w2fm-2cpv-w7v5; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-w2fm-2cpv-w7v5"},{"rule_id":"osv/GHSA-2vrm-gr82-f7m5","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2096, GHSA-2vrm-gr82-f7m5; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-2vrm-gr82-f7m5"},{"rule_id":"osv/GHSA-3wq7-rqq7-wx6j","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2099, GHSA-3wq7-rqq7-wx6j; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-3wq7-rqq7-wx6j"},{"rule_id":"osv/GHSA-966j-vmvw-g2g9","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2100, GHSA-966j-vmvw-g2g9; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-966j-vmvw-g2g9"},{"rule_id":"osv/GHSA-mwh4-6h8g-pg8w","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2101, GHSA-mwh4-6h8g-pg8w; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-mwh4-6h8g-pg8w"},{"rule_id":"osv/GHSA-c427-h43c-vf67","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2103, GHSA-c427-h43c-vf67; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-c427-h43c-vf67"},{"rule_id":"osv/GHSA-hpj7-wq8m-9hgp","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-2109, GHSA-hpj7-wq8m-9hgp; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-hpj7-wq8m-9hgp"},{"rule_id":"osv/GHSA-mfx4-hv73-q22v","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-3546, GHSA-mfx4-hv73-q22v; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-mfx4-hv73-q22v"},{"rule_id":"osv/GHSA-mq44-7p77-q5h7","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-3547, GHSA-mq44-7p77-q5h7; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-mq44-7p77-q5h7"},{"rule_id":"osv/GHSA-494j-54xm-rwp3","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by GHSA-494j-54xm-rwp3; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-494j-54xm-rwp3"},{"rule_id":"osv/GHSA-6cjc-53gc-5rqm","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by GHSA-6cjc-53gc-5rqm; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-6cjc-53gc-5rqm"},{"rule_id":"osv/GHSA-f9xw-jh8m-3mwq","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by GHSA-f9xw-jh8m-3mwq; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-f9xw-jh8m-3mwq"},{"rule_id":"osv/GHSA-pqxq-w44r-73xw","severity":"medium","message":"aiohttp@3.13 (PyPI) is affected by GHSA-pqxq-w44r-73xw; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-pqxq-w44r-73xw"},{"rule_id":"osv/GHSA-hpj7-wq8m-9hgp","severity":"medium","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-2109, GHSA-hpj7-wq8m-9hgp; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-hpj7-wq8m-9hgp"},{"rule_id":"osv/GHSA-mfx4-hv73-q22v","severity":"medium","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-3546, GHSA-mfx4-hv73-q22v; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-mfx4-hv73-q22v"},{"rule_id":"osv/GHSA-mq44-7p77-q5h7","severity":"medium","message":"aiohttp@3.14 (PyPI) is affected by PYSEC-2026-3547, GHSA-mq44-7p77-q5h7; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-mq44-7p77-q5h7"},{"rule_id":"osv/GHSA-494j-54xm-rwp3","severity":"medium","message":"aiohttp@3.14 (PyPI) is affected by GHSA-494j-54xm-rwp3; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-494j-54xm-rwp3"},{"rule_id":"osv/GHSA-6cjc-53gc-5rqm","severity":"medium","message":"aiohttp@3.14 (PyPI) is affected by GHSA-6cjc-53gc-5rqm; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-6cjc-53gc-5rqm"},{"rule_id":"osv/GHSA-f9xw-jh8m-3mwq","severity":"medium","message":"aiohttp@3.14 (PyPI) is affected by GHSA-f9xw-jh8m-3mwq; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-f9xw-jh8m-3mwq"},{"rule_id":"osv/GHSA-pqxq-w44r-73xw","severity":"medium","message":"aiohttp@3.14 (PyPI) is affected by GHSA-pqxq-w44r-73xw; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-pqxq-w44r-73xw"},{"rule_id":"osv/GHSA-6w46-j5rx-g56g","severity":"medium","message":"pytest@7.0.0 (PyPI) is affected by PYSEC-2026-1845, GHSA-6w46-j5rx-g56g","path":"requirements-dev.txt","line":null,"fingerprint":"pytest@7.0.0 (PyPI):GHSA-6w46-j5rx-g56g"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.6 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.6 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@3.1.6 (npm) is affected by GHSA-wjr9-j795-jxcr","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-54jq-c3m8-4m76","severity":"low","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1097, GHSA-54jq-c3m8-4m76; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-54jq-c3m8-4m76"},{"rule_id":"osv/GHSA-69f9-5gxw-wvc2","severity":"low","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1099, GHSA-69f9-5gxw-wvc2; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-69f9-5gxw-wvc2"},{"rule_id":"osv/GHSA-fh55-r93g-j68g","severity":"low","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1105, GHSA-fh55-r93g-j68g; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-fh55-r93g-j68g"},{"rule_id":"osv/GHSA-mqqc-3gqh-h2x8","severity":"low","message":"aiohttp@3.13 (PyPI) is affected by PYSEC-2026-1109, GHSA-mqqc-3gqh-h2x8; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-mqqc-3gqh-h2x8"},{"rule_id":"osv/GHSA-gx76-c99x-2c96","severity":"low","message":"aiohttp@3.13 (PyPI) is affected by GHSA-gx76-c99x-2c96; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.13 (PyPI):GHSA-gx76-c99x-2c96"},{"rule_id":"osv/GHSA-gx76-c99x-2c96","severity":"low","message":"aiohttp@3.14 (PyPI) is affected by GHSA-gx76-c99x-2c96; also in requirements.txt","path":"requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14 (PyPI):GHSA-gx76-c99x-2c96"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.6 (npm) is affected by GHSA-333x-w4r6-6crp","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.6 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-m5mm-p8h7-m29v","severity":"low","message":"serialize-javascript@7.0.5 (npm) is affected by GHSA-m5mm-p8h7-m29v","path":"streamdeck-plugin/package-lock.json","line":null,"fingerprint":"serialize-javascript@7.0.5 (npm):GHSA-m5mm-p8h7-m29v"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":28.0,"findings_high":17.0,"findings_medium":5.0,"findings_low":6.0,"penalty":175.5},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:47"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":49,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":70,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:70"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":72,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:72"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":93,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:93"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":95,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:95"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":110,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:110"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":114,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:114"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":143,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:143"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":151,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:151"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":21,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":49,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:49"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":72,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:72"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":95,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:95"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":114,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:114"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":11,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:11"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":44,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:44"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":67,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:67"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":90,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:90"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":19,"fingerprint":"artipacked:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":47,"fingerprint":"artipacked:.github/workflows/ci.yml:47"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":70,"fingerprint":"artipacked:.github/workflows/ci.yml:70"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":93,"fingerprint":"artipacked:.github/workflows/ci.yml:93"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":110,"fingerprint":"artipacked:.github/workflows/ci.yml:110"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/ci.yml","line":151,"fingerprint":"superfluous-actions:.github/workflows/ci.yml:151"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":10.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v3.0.0 ships sc-sp-remote-core-v3.0.0.zip (6 downloads)","ref":"sc-sp-remote-core-v3.0.0.zip","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v3.0.0/sc-sp-remote-core-v3.0.0.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v2.3.0 ships sc-sp-remote-core-v2.3.0.zip (3 downloads)","ref":"sc-sp-remote-core-v2.3.0.zip","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.3.0/sc-sp-remote-core-v2.3.0.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v2.2.0 ships sc-sp-remote-core-v2.2.0.zip (3 downloads)","ref":"sc-sp-remote-core-v2.2.0.zip","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.2.0/sc-sp-remote-core-v2.2.0.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v2.1.0 ships sc-sp-remote-core-v2.1.0.zip (2 downloads)","ref":"sc-sp-remote-core-v2.1.0.zip","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.1.0/sc-sp-remote-core-v2.1.0.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v2.0.0 ships sc-sp-remote-core-v2.0.0.zip (4 downloads)","ref":"sc-sp-remote-core-v2.0.0.zip","url":"https://github.com/dekub100/sc-sp-remote/releases/download/v2.0.0/sc-sp-remote-core-v2.0.0.zip","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":466.0,"function_nloc":4647.0,"mean_ccn":3.2,"p90_ccn":7.0,"complex_functions":9.0,"long_functions":2.0,"many_param_functions":0.0,"risky_nloc_share":0.2148},"findings":[],"evidence":[{"kind":"complex-function","description":"fetch_and_broadcast_lyrics in server/lyrics.py: complexity 31, 109 lines","ref":"server/lyrics.py","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/server/lyrics.py#L358","weight":0.5166666666666667},{"kind":"complex-function","description":"checkTrackChange in spicetify-extension/remoteVolume.js: complexity 24, 26 lines","ref":"spicetify-extension/remoteVolume.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/spicetify-extension/remoteVolume.js#L406","weight":0.4},{"kind":"complex-function","description":"applySpotifyNowPlaying in web/script.js: complexity 23, 56 lines","ref":"web/script.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/web/script.js#L344","weight":0.38333333333333336},{"kind":"complex-function","description":"_fetch_musixmatch in server/lyrics.py: complexity 22, 72 lines","ref":"server/lyrics.py","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/server/lyrics.py#L179","weight":0.36666666666666664},{"kind":"complex-function","description":"handleCommand in spicetify-extension/remoteVolume.js: complexity 21, 58 lines","ref":"spicetify-extension/remoteVolume.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/spicetify-extension/remoteVolume.js#L504","weight":0.35},{"kind":"complex-function","description":"syncFullState in spicetify-extension/remoteVolume.js: complexity 21, 29 lines","ref":"spicetify-extension/remoteVolume.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/spicetify-extension/remoteVolume.js#L333","weight":0.35},{"kind":"complex-function","description":"handle_admin_config_put in server/routes.py: complexity 17, 42 lines","ref":"server/routes.py","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/server/routes.py#L391","weight":0.2833333333333333},{"kind":"complex-function","description":"applyServerState in spicetify-extension/remoteVolume.js: complexity 16, 47 lines","ref":"spicetify-extension/remoteVolume.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/spicetify-extension/remoteVolume.js#L451","weight":0.26666666666666666},{"kind":"complex-function","description":"applySoundCloudNowPlaying in web/script.js: complexity 16, 49 lines","ref":"web/script.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/web/script.js#L408","weight":0.26666666666666666},{"kind":"complex-function","description":"contentScript in soundcloud-plugin/soundcloud-remote-bridge.js: complexity 1, 510 lines","ref":"soundcloud-plugin/soundcloud-remote-bridge.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/soundcloud-plugin/soundcloud-remote-bridge.js#L13","weight":0.016666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":4882.0,"duplicated_lines":137.0,"duplicated_share":0.0281,"files":38.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: server/lyrics.py:395 and server/server.py:67","ref":"server/lyrics.py","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/server/lyrics.py#L395","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: spicetify-extension/remoteVolume.js:350 and spicetify-extension/remoteVolume.js:420","ref":"spicetify-extension/remoteVolume.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/spicetify-extension/remoteVolume.js#L350","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: streamdeck-plugin/com.dekub.sc-sp-remote.sdPlugin/ui/seek-pi.js:12 and streamdeck-plugin/com.dekub.sc-sp-remote.sdPlugin/ui/source-pi.js:8","ref":"streamdeck-plugin/com.dekub.sc-sp-remote.sdPlugin/ui/seek-pi.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/streamdeck-plugin/com.dekub.sc-sp-remote.sdPlugin/ui/seek-pi.js#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: streamdeck-plugin/src/actions/play-pause.ts:2 and streamdeck-plugin/src/actions/toggle-like.ts:2","ref":"streamdeck-plugin/src/actions/play-pause.ts","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/streamdeck-plugin/src/actions/play-pause.ts#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: streamdeck-plugin/src/actions/toggle-like.ts:20 and streamdeck-plugin/src/actions/toggle-repeat.ts:20","ref":"streamdeck-plugin/src/actions/toggle-like.ts","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/streamdeck-plugin/src/actions/toggle-like.ts#L20","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: web/obs-widget/obs-script.js:338 and web/script.js:507","ref":"web/obs-widget/obs-script.js","url":"https://github.com/dekub100/sc-sp-remote/blob/3e2d754190d45d2abe51a23162c981c94d3e5702/web/obs-widget/obs-script.js#L338","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":18.0,"weighted_findings":20.25,"scanned_lines":6649.0,"category:best-practice":7.0,"category:correctness":6.0,"category:maintainability":5.0},"findings":[{"rule_id":"opengrep/python.lang.correctness.common-mistakes.identical-is-comparison","severity":"high","message":"Found identical comparison using is. Ensure this is what you intended.","path":"manage.py","line":433,"fingerprint":"python.lang.correctness.common-mistakes.identical-is-comparison:manage.py:433"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"manage.py","line":459,"fingerprint":"python.lang.best-practice.arbitrary-sleep:manage.py:459"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"manage.py","line":590,"fingerprint":"python.lang.best-practice.arbitrary-sleep:manage.py:590"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"manage.py","line":132,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:manage.py:132"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"manage.py","line":141,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:manage.py:141"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"manage.py","line":324,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:manage.py:324"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"server/lyrics.py","line":68,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:server/lyrics.py:68"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant address.is_loopback() because address.is_loopback is always true.","path":"server/routes.py","line":91,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:server/routes.py:91"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_private\" a function or an attribute? If it is a function, you may have meant address.is_private() because address.is_private is always true.","path":"server/routes.py","line":91,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:server/routes.py:91"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_link_local\" a function or an attribute? If it is a function, you may have meant address.is_link_local() because address.is_link_local is always true.","path":"server/routes.py","line":91,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:server/routes.py:91"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(remote).is_loopback() because ipaddress.ip_address(remote).is_loopback is always true.","path":"server/routes.py","line":119,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:server/routes.py:119"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"server/state.py","line":135,"fingerprint":"python.lang.maintainability.return-not-in-function:server/state.py:135"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"server/state.py","line":231,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:server/state.py:231"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"soundcloud-plugin/soundcloud-remote-bridge.js","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:soundcloud-plugin/soundcloud-remote-bridge.js:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"soundcloud-plugin/soundcloud-remote-bridge.js","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:soundcloud-plugin/soundcloud-remote-bridge.js:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"spicetify-extension/remoteVolume.js","line":70,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:spicetify-extension/remoteVolume.js:70"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"spicetify-extension/remoteVolume.js","line":70,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:spicetify-extension/remoteVolume.js:70"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"streamdeck-plugin/rollup.config.mjs","line":43,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:streamdeck-plugin/rollup.config.mjs:43"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8353,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":2777.0,"source_lines":6649.0,"test_ratio":0.4177,"ci_files":1.0,"cochange_share":0.3409,"cochange_commits":88.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff, tsc --noEmit)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest"],"lint_commands":["ruff","tsc --noEmit"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":54.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":144.0,"escapes_per_kloc":36.181},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}