{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:04.003798Z","repo":{"ref":{"host":"github.com","owner":"dobin","name":"REvAId"},"default_branch":"main","clone_url":"https://github.com/dobin/REvAId.git","html_url":"https://github.com/dobin/REvAId","description":"AI Assisted Binary REversing AId","stars":2,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3424,"primary_language":"Python","license_spdx":"GPL-3.0","created_at":"2026-08-23T09:07:14Z","pushed_at":"2026-11-02T19:11:48Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-01-12T09:12:14Z","owner_type":"User","release_assets":[]}},"commit_sha":"773676b1533fe2e8fb9063a013bbb59abc006f38","profile":{"lines_by_language":{"Python":28253,"TypeScript":16589,"Java":727,"PowerShell":63,"JavaScript":56,"Shell":37},"files_by_category":{"source":264,"test":105,"config":17,"docs":11,"other":6,"oversized":3,"binary":3,"generated":2},"source_lines":29362,"test_lines":16363},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.2982,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":7.0,"flagged_releases":null,"style_index":0.085},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":77.5,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":73.6,"duplication":55.9,"lint":67.5,"testing":100.0,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.56, CI runs tests; 10% of function code in complex or long functions; 10% duplicated lines. Weakest area: duplication."},"security":{"score":53.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":87.0,"dependencies":5.5,"ci_actions":29.5,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 64 known vulnerabilities in 22 dependencies; 10 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":63.0,"checked":63.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":172.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":52820.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-08":{"loc":31095,"attributed_loc":0},"2026-09":{"loc":21379,"attributed_loc":0},"2026-10":{"loc":346,"attributed_loc":0},"2026-11":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":72.0,"flagged_units":7.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":39881.0,"flagged_loc":15750.0,"flagged_loc_share":0.39492490158220706,"max_loc_per_hour":2973.095823095823,"median_loc_per_hour":169.5067264573991,"pr_timed_units":0.0,"excluded_import_loc":12939.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,689 lines of first-party code in ~0.9h (2,973 lines/hour, 1 commit session)","ref":"c4085947dc52c7b2947dd701c6fabf2c4cae9dc2","url":"https://github.com/dobin/REvAId/commit/c4085947dc52c7b2947dd701c6fabf2c4cae9dc2","weight":0.6},{"kind":"velocity-burst","description":"2,568 lines of first-party code in ~1.9h (1,372 lines/hour, 2 commit session)","ref":"1ae04d86c170ea75177a0a417cb36425a50f2c9d","url":"https://github.com/dobin/REvAId/commit/1ae04d86c170ea75177a0a417cb36425a50f2c9d","weight":0.4115506751743582},{"kind":"velocity-burst","description":"2,250 lines of first-party code in ~2.3h (962 lines/hour, 1 commit session)","ref":"79fb5c9371d41f3f9ae2620712a0567e602e1cc3","url":"https://github.com/dobin/REvAId/commit/79fb5c9371d41f3f9ae2620712a0567e602e1cc3","weight":0.28846153846153844},{"kind":"velocity-burst","description":"1,447 lines of first-party code in ~1.7h (855 lines/hour, 2 commit session)","ref":"4b816d6015280fb68573a6e2638e4094a29de64b","url":"https://github.com/dobin/REvAId/commit/4b816d6015280fb68573a6e2638e4094a29de64b","weight":0.25644240236298},{"kind":"velocity-burst","description":"3,033 lines of first-party code in ~4.0h (758 lines/hour, 1 commit session)","ref":"328afa6a522ef8505fb088fdeb4e3ac702f6d258","url":"https://github.com/dobin/REvAId/commit/328afa6a522ef8505fb088fdeb4e3ac702f6d258","weight":0.22747499999999998},{"kind":"velocity-burst","description":"2,559 lines of first-party code in ~4.2h (603 lines/hour, 2 commit session)","ref":"5e5f36cd7c903a70c49118bbd214af5d54c04e6e","url":"https://github.com/dobin/REvAId/commit/5e5f36cd7c903a70c49118bbd214af5d54c04e6e","weight":0.18087172774869106},{"kind":"velocity-burst","description":"1,204 lines of first-party code in ~2.4h (510 lines/hour, 1 commit session)","ref":"a8075be3176693eb0b2c23b10737f49f4fb6a07d","url":"https://github.com/dobin/REvAId/commit/a8075be3176693eb0b2c23b10737f49f4fb6a07d","weight":0.15296082813786613}],"data":{"flagged_loc_by_commit":{"79fb5c9371d41f3f9ae2620712a0567e602e1cc3":2250,"c4085947dc52c7b2947dd701c6fabf2c4cae9dc2":2689,"506be9f97d2bfbe742ef870a93eb45a6dc82664f":1457,"1ae04d86c170ea75177a0a417cb36425a50f2c9d":1111,"a8075be3176693eb0b2c23b10737f49f4fb6a07d":1204,"59c819b65e997936f4a745d9d0928e0233fd13b1":1299,"4b816d6015280fb68573a6e2638e4094a29de64b":148,"328afa6a522ef8505fb088fdeb4e3ac702f6d258":3033,"b2a9dd898fa79c0c815ee8006d359d3d641c26df":2195,"5e5f36cd7c903a70c49118bbd214af5d54c04e6e":364},"excluded_import_commits":["0c77fddbf7038a1b14e560790f852e3ce5279d21","3c611d2ed8f0d84e830120e3f1a2bde0fcb9c93a","84d8869997504633a759dcdfd380f15d48aea3e0"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":29362.0,"index":0.085,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":5.0,"per_kloc:emoji_in_code":0.17,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":14.0,"findings_high":10.0,"findings_medium":4.0,"findings_low":0.0,"weighted_findings":11.65,"scanned_lines":29299.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"backend/src/revaid/cli/dbtools.py","line":21,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:backend/src/revaid/cli/dbtools.py:21"},{"rule_id":"opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text","severity":"high","message":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]","path":"backend/src/revaid/cli/dbtools.py","line":62,"fingerprint":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text:backend/src/revaid/cli/dbtools.py:62"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"backend/src/revaid/cli/ingest.py","line":171,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:backend/src/revaid/cli/ingest.py:171"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"backend/src/revaid/db/engine.py","line":38,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:backend/src/revaid/db/engine.py:38"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"backend/src/revaid/db/engine.py","line":39,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:backend/src/revaid/db/engine.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"backend/src/revaid/ingestion/import_jobs.py","line":322,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:backend/src/revaid/ingestion/import_jobs.py:322"},{"rule_id":"opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text","severity":"high","message":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]","path":"backend/src/revaid/repositories/functions.py","line":468,"fingerprint":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text:backend/src/revaid/repositories/functions.py:468"},{"rule_id":"opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text","severity":"high","message":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]","path":"backend/src/revaid_ui/cli/dbtools.py","line":26,"fingerprint":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text:backend/src/revaid_ui/cli/dbtools.py:26"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"backend/src/revaid_ui/db/engine.py","line":29,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:backend/src/revaid_ui/db/engine.py:29"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"backend/src/revaid_ui/db/engine.py","line":30,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:backend/src/revaid_ui/db/engine.py:30"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"backend/src/revaid/db/engine.py","line":38,"fingerprint":"python.lang.security.audit.formatted-sql-query:backend/src/revaid/db/engine.py:38"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"backend/src/revaid/db/engine.py","line":39,"fingerprint":"python.lang.security.audit.formatted-sql-query:backend/src/revaid/db/engine.py:39"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"backend/src/revaid_ui/db/engine.py","line":29,"fingerprint":"python.lang.security.audit.formatted-sql-query:backend/src/revaid_ui/db/engine.py:29"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"backend/src/revaid_ui/db/engine.py","line":30,"fingerprint":"python.lang.security.audit.formatted-sql-query:backend/src/revaid_ui/db/engine.py:30"}],"evidence":[],"data":{"rulesets":["python","typescript","javascript","java","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":22.0,"vulnerabilities":64.0,"vulns_critical":5.0,"vulns_high":18.0,"vulns_medium":36.0,"vulns_low":5.0,"vulns_unknown":0.0,"penalty":174.0},"findings":[{"rule_id":"osv/GHSA-6q48-6c7w-9gw2","severity":"critical","message":"certifi@2026.7.22 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2","path":"backend/uv.lock","line":null,"fingerprint":"certifi@2026.7.22 (PyPI):GHSA-6q48-6c7w-9gw2"},{"rule_id":"osv/GHSA-7hp6-4w63-5g45","severity":"critical","message":"litellm@1.98.0 (PyPI) is affected by GHSA-7hp6-4w63-5g45","path":"backend/uv.lock","line":null,"fingerprint":"litellm@1.98.0 (PyPI):GHSA-7hp6-4w63-5g45"},{"rule_id":"osv/GHSA-5gmw-xhrv-c9v3","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3","path":"frontend/package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-5gmw-xhrv-c9v3"},{"rule_id":"osv/GHSA-85c8-ppgw-ccpr","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr","path":"frontend/package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-85c8-ppgw-ccpr"},{"rule_id":"osv/GHSA-5xrq-8626-4rwp","severity":"critical","message":"vitest@2.1.9 (npm) is affected by GHSA-5xrq-8626-4rwp","path":"frontend/package-lock.json","line":null,"fingerprint":"vitest@2.1.9 (npm):GHSA-5xrq-8626-4rwp"},{"rule_id":"osv/GHSA-2g87-pp6c-29x5","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-2g87-pp6c-29x5","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-2g87-pp6c-29x5"},{"rule_id":"osv/GHSA-5wr8-gcqf-gqf3","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-5wr8-gcqf-gqf3","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-5wr8-gcqf-gqf3"},{"rule_id":"osv/GHSA-9xw5-w5jj-pvcg","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-9xw5-w5jj-pvcg","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-9xw5-w5jj-pvcg"},{"rule_id":"osv/GHSA-v4x8-3wr5-3wq8","severity":"high","message":"filelock@3.32.4 (PyPI) is affected by GHSA-v4x8-3wr5-3wq8","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-v4x8-3wr5-3wq8"},{"rule_id":"osv/GHSA-x33g-cr3x-6449","severity":"high","message":"pyjwt@2.14.0 (PyPI) is affected by PYSEC-2026-4183, GHSA-x33g-cr3x-6449","path":"backend/uv.lock","line":null,"fingerprint":"pyjwt@2.14.0 (PyPI):GHSA-x33g-cr3x-6449"},{"rule_id":"osv/GHSA-8988-9cw3-xx77","severity":"high","message":"urllib3@2.7.0 (PyPI) is affected by PYSEC-2026-4175, GHSA-8988-9cw3-xx77","path":"backend/uv.lock","line":null,"fingerprint":"urllib3@2.7.0 (PyPI):GHSA-8988-9cw3-xx77"},{"rule_id":"osv/GHSA-vxq7-64xx-v4gw","severity":"high","message":"urllib3@2.7.0 (PyPI) is affected by PYSEC-2026-4177, GHSA-vxq7-64xx-v4gw","path":"backend/uv.lock","line":null,"fingerprint":"urllib3@2.7.0 (PyPI):GHSA-vxq7-64xx-v4gw"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.3.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"frontend/package-lock.json","line":null,"fingerprint":"js-yaml@4.3.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"frontend/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@6.4.3 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"frontend/package-lock.json","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-494j-54xm-rwp3","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-494j-54xm-rwp3","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-494j-54xm-rwp3"},{"rule_id":"osv/GHSA-6cjc-53gc-5rqm","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-6cjc-53gc-5rqm","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-6cjc-53gc-5rqm"},{"rule_id":"osv/GHSA-f9xw-jh8m-3mwq","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-f9xw-jh8m-3mwq","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-f9xw-jh8m-3mwq"},{"rule_id":"osv/GHSA-pqxq-w44r-73xw","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-pqxq-w44r-73xw","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-pqxq-w44r-73xw"},{"rule_id":"osv/GHSA-6627-m3xw-93mp","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-6627-m3xw-93mp","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-6627-m3xw-93mp"},{"rule_id":"osv/GHSA-69hj-f68j-2879","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-69hj-f68j-2879","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-69hj-f68j-2879"},{"rule_id":"osv/GHSA-8mx5-7m5m-r77g","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-8mx5-7m5m-r77g","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-8mx5-7m5m-r77g"},{"rule_id":"osv/GHSA-9c4x-gm8v-wgc4","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-9c4x-gm8v-wgc4","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-9c4x-gm8v-wgc4"},{"rule_id":"osv/GHSA-cwqr-hh33-gh44","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-cwqr-hh33-gh44","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-cwqr-hh33-gh44"},{"rule_id":"osv/GHSA-fq56-3cx3-fjxp","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-fq56-3cx3-fjxp","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-fq56-3cx3-fjxp"},{"rule_id":"osv/GHSA-j8f7-rjxc-mr56","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-j8f7-rjxc-mr56","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-j8f7-rjxc-mr56"},{"rule_id":"osv/GHSA-m462-7rxw-wvpg","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-m462-7rxw-wvpg","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-m462-7rxw-wvpg"},{"rule_id":"osv/GHSA-rfpc-qcw5-3pc4","severity":"medium","message":"filelock@3.32.4 (PyPI) is affected by GHSA-rfpc-qcw5-3pc4","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-rfpc-qcw5-3pc4"},{"rule_id":"osv/GHSA-5639-2j2p-m4mx","severity":"medium","message":"mako@1.4.1 (PyPI) is affected by PYSEC-2026-4243, GHSA-5639-2j2p-m4mx","path":"backend/uv.lock","line":null,"fingerprint":"mako@1.4.1 (PyPI):GHSA-5639-2j2p-m4mx"},{"rule_id":"osv/GHSA-54p9-h82j-f925","severity":"medium","message":"multidict@6.7.1 (PyPI) is affected by PYSEC-2026-4244, GHSA-54p9-h82j-f925","path":"backend/uv.lock","line":null,"fingerprint":"multidict@6.7.1 (PyPI):GHSA-54p9-h82j-f925"},{"rule_id":"osv/GHSA-mf5v-w3w3-f6cg","severity":"medium","message":"opentelemetry-api@1.44.0 (PyPI) is affected by GHSA-mf5v-w3w3-f6cg","path":"backend/uv.lock","line":null,"fingerprint":"opentelemetry-api@1.44.0 (PyPI):GHSA-mf5v-w3w3-f6cg"},{"rule_id":"osv/GHSA-xcq7-p3pf-p88h","severity":"medium","message":"opentelemetry-api@1.44.0 (PyPI) is affected by GHSA-xcq7-p3pf-p88h","path":"backend/uv.lock","line":null,"fingerprint":"opentelemetry-api@1.44.0 (PyPI):GHSA-xcq7-p3pf-p88h"},{"rule_id":"osv/GHSA-42vr-xj54-vc7v","severity":"medium","message":"pyjwt@2.14.0 (PyPI) is affected by PYSEC-2026-4141, GHSA-42vr-xj54-vc7v","path":"backend/uv.lock","line":null,"fingerprint":"pyjwt@2.14.0 (PyPI):GHSA-42vr-xj54-vc7v"},{"rule_id":"osv/GHSA-gh4c-6fx4-qh6g","severity":"medium","message":"urllib3@2.7.0 (PyPI) is affected by PYSEC-2026-4176, GHSA-gh4c-6fx4-qh6g","path":"backend/uv.lock","line":null,"fingerprint":"urllib3@2.7.0 (PyPI):GHSA-gh4c-6fx4-qh6g"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@2.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"frontend/package-lock.json","line":null,"fingerprint":"@vitest/mocker@2.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@2.1.9 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"frontend/package-lock.json","line":null,"fingerprint":"@vitest/mocker@2.1.9 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.21.5 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"frontend/package-lock.json","line":null,"fingerprint":"esbuild@0.21.5 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"frontend/package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@2.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"frontend/package-lock.json","line":null,"fingerprint":"vitest@2.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-gx76-c99x-2c96","severity":"low","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-gx76-c99x-2c96","path":"backend/uv.lock","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-gx76-c99x-2c96"},{"rule_id":"osv/GHSA-567q-5qvw-pf92","severity":"low","message":"filelock@3.32.4 (PyPI) is affected by GHSA-567q-5qvw-pf92","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-567q-5qvw-pf92"},{"rule_id":"osv/GHSA-9vhv-jxww-xfm5","severity":"low","message":"filelock@3.32.4 (PyPI) is affected by GHSA-9vhv-jxww-xfm5","path":"backend/uv.lock","line":null,"fingerprint":"filelock@3.32.4 (PyPI):GHSA-9vhv-jxww-xfm5"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@5.4.21 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-9jrq-w75r-8gcw"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@6.4.3 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":12.0,"findings_high":5.0,"findings_medium":7.0,"findings_low":0.0,"penalty":73.2},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":48,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:48"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":50,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:50"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":75,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:75"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":16,"fingerprint":"artipacked:.github/workflows/ci.yml:16"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":48,"fingerprint":"artipacked:.github/workflows/ci.yml:48"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":75,"fingerprint":"artipacked:.github/workflows/ci.yml:75"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:9"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":41,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:41"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":71,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:71"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0058,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1138.0,"function_nloc":15022.0,"mean_ccn":2.77,"p90_ccn":7.0,"complex_functions":12.0,"long_functions":6.0,"many_param_functions":26.0,"risky_nloc_share":0.102},"findings":[],"evidence":[{"kind":"complex-function","description":"ImportBinaryButton in frontend/src/features/sidebar/ImportBinaryButton.tsx: complexity 52, 168 lines","ref":"frontend/src/features/sidebar/ImportBinaryButton.tsx","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/frontend/src/features/sidebar/ImportBinaryButton.tsx#L110","weight":0.8666666666666667},{"kind":"complex-function","description":"reconcile_viewer_state in backend/src/revaid_ui/db/startup.py: complexity 40, 99 lines","ref":"backend/src/revaid_ui/db/startup.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid_ui/db/startup.py#L16","weight":0.6666666666666666},{"kind":"complex-function","description":"open_functions in backend/src/revaid_ui/services/canvas_service.py: complexity 36, 156 lines","ref":"backend/src/revaid_ui/services/canvas_service.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid_ui/services/canvas_service.py#L142","weight":0.6},{"kind":"complex-function","description":"FunctionSearchPanel in frontend/src/features/search/FunctionSearchPanel.tsx: complexity 23, 110 lines","ref":"frontend/src/features/search/FunctionSearchPanel.tsx","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/frontend/src/features/search/FunctionSearchPanel.tsx#L16","weight":0.38333333333333336},{"kind":"complex-function","description":"(anonymous) in frontend/src/features/search/FunctionSearchPanel.tsx: complexity 21, 57 lines","ref":"frontend/src/features/search/FunctionSearchPanel.tsx","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/frontend/src/features/search/FunctionSearchPanel.tsx#L159","weight":0.35},{"kind":"complex-function","description":"FunctionSearchInput in frontend/src/features/sidebar/FunctionSearchInput.tsx: complexity 19, 81 lines","ref":"frontend/src/features/sidebar/FunctionSearchInput.tsx","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/frontend/src/features/sidebar/FunctionSearchInput.tsx#L60","weight":0.31666666666666665},{"kind":"complex-function","description":"offsetPastObstacles in frontend/src/features/canvas/layout/elkLayout.ts: complexity 17, 39 lines","ref":"frontend/src/features/canvas/layout/elkLayout.ts","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/frontend/src/features/canvas/layout/elkLayout.ts#L77","weight":0.2833333333333333},{"kind":"complex-function","description":"internal_import_upload in backend/src/revaid/api/routers/internal.py: complexity 16, 61 lines","ref":"backend/src/revaid/api/routers/internal.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/api/routers/internal.py#L240","weight":0.26666666666666666},{"kind":"complex-function","description":"_ingest_one_binary in backend/src/revaid/ingestion/pipeline.py: complexity 16, 89 lines","ref":"backend/src/revaid/ingestion/pipeline.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/ingestion/pipeline.py#L79","weight":0.26666666666666666},{"kind":"complex-function","description":"_resolve_function in backend/src/revaid/services/mcp_service.py: complexity 16, 53 lines","ref":"backend/src/revaid/services/mcp_service.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/services/mcp_service.py#L406","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":21585.0,"duplicated_lines":2092.0,"duplicated_share":0.0969,"files":264.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: backend/migrations/env.py:35 and backend/viewer_migrations/env.py:29","ref":"backend/migrations/env.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/migrations/env.py#L35","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/migrations/versions/0001_initial.py:138 and backend/migrations/versions/0008_add_edge_callee_order.py:42","ref":"backend/migrations/versions/0001_initial.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/migrations/versions/0001_initial.py#L138","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/migrations/versions/0001_initial.py:164 and backend/viewer_migrations/versions/0002_canvas_state.py:21","ref":"backend/migrations/versions/0001_initial.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/migrations/versions/0001_initial.py#L164","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/migrations/versions/0001_initial.py:194 and backend/migrations/versions/0004_view_node_origin_kind_fanin.py:46","ref":"backend/migrations/versions/0001_initial.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/migrations/versions/0001_initial.py#L194","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/src/revaid/adapters/ghidra/file.py:22 and backend/src/revaid/adapters/ghidra/mock.py:46","ref":"backend/src/revaid/adapters/ghidra/file.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/adapters/ghidra/file.py#L22","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/src/revaid/adapters/llm/litellm_adapter.py:60 and backend/src/revaid/adapters/llm/opencode_adapter.py:59","ref":"backend/src/revaid/adapters/llm/litellm_adapter.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/adapters/llm/litellm_adapter.py#L60","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/src/revaid/api/routers/binaries.py:27 and backend/src/revaid_ui/api/routers/binaries.py:87","ref":"backend/src/revaid/api/routers/binaries.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/api/routers/binaries.py#L27","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/src/revaid/api/routers/events.py:1 and backend/src/revaid_ui/api/routers/events.py:1","ref":"backend/src/revaid/api/routers/events.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/api/routers/events.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/src/revaid/cli/binaries.py:47 and backend/src/revaid/cli/ingest.py:38","ref":"backend/src/revaid/cli/binaries.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/cli/binaries.py#L47","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/src/revaid/cli/ingest.py:238 and backend/src/revaid/ingestion/import_jobs.py:62","ref":"backend/src/revaid/cli/ingest.py","url":"https://github.com/dobin/REvAId/blob/773676b1533fe2e8fb9063a013bbb59abc006f38/backend/src/revaid/cli/ingest.py#L238","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":40.0,"weighted_findings":46.0,"scanned_lines":29299.0,"category:best-practice":7.0,"category:maintainability":33.0},"findings":[{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `_set_sqlite_pragmas` is defined inside a function but never used","path":"backend/src/revaid/db/engine.py","line":33,"fingerprint":"python.lang.maintainability.useless-inner-function:backend/src/revaid/db/engine.py:33"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `request_id_middleware` is defined inside a function but never used","path":"backend/src/revaid_contracts/app_base.py","line":29,"fingerprint":"python.lang.maintainability.useless-inner-function:backend/src/revaid_contracts/app_base.py:29"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `set_sqlite_pragmas` is defined inside a function but never used","path":"backend/src/revaid_ui/db/engine.py","line":24,"fingerprint":"python.lang.maintainability.useless-inner-function:backend/src/revaid_ui/db/engine.py:24"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant fn.is_entry_point() because fn.is_entry_point is always true.","path":"backend/src/revaid/adapters/ghidra/file.py","line":53,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/adapters/ghidra/file.py:53"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant function.is_entry_point() because function.is_entry_point is always true.","path":"backend/src/revaid/api/routers/internal.py","line":150,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:150"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_featured\" a function or an attribute? If it is a function, you may have meant function.is_featured() because function.is_featured is always true.","path":"backend/src/revaid/api/routers/internal.py","line":151,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:151"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility_effective\" a function or an attribute? If it is a function, you may have meant function.is_utility_effective() because function.is_utility_effective is always true.","path":"backend/src/revaid/api/routers/internal.py","line":152,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:152"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant dto.is_entry_point() because dto.is_entry_point is always true.","path":"backend/src/revaid/api/routers/internal.py","line":414,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:414"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_featured\" a function or an attribute? If it is a function, you may have meant function.is_featured() because function.is_featured is always true.","path":"backend/src/revaid/api/routers/internal.py","line":415,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:415"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility\" a function or an attribute? If it is a function, you may have meant dto.is_utility() because dto.is_utility is always true.","path":"backend/src/revaid/api/routers/internal.py","line":416,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:416"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_writable\" a function or an attribute? If it is a function, you may have meant row.item.is_writable() because row.item.is_writable is always true.","path":"backend/src/revaid/api/routers/internal.py","line":458,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:458"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_featured\" a function or an attribute? If it is a function, you may have meant Function.is_featured() because Function.is_featured is always true.","path":"backend/src/revaid/api/routers/internal.py","line":582,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:582"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility_effective\" a function or an attribute? If it is a function, you may have meant row.function.is_utility_effective() because row.function.is_utility_effective is always true.","path":"backend/src/revaid/api/routers/internal.py","line":662,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:662"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_self\" a function or an attribute? If it is a function, you may have meant row.is_self() because row.is_self is always true.","path":"backend/src/revaid/api/routers/internal.py","line":665,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/api/routers/internal.py:665"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_writable\" a function or an attribute? If it is a function, you may have meant i.is_writable() because i.is_writable is always true.","path":"backend/src/revaid/ingestion/pe_data/enrich.py","line":137,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/ingestion/pe_data/enrich.py:137"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant raw_fn.is_entry_point() because raw_fn.is_entry_point is always true.","path":"backend/src/revaid/ingestion/pipeline.py","line":75,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/ingestion/pipeline.py:75"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant raw_fn.is_entry_point() because raw_fn.is_entry_point is always true.","path":"backend/src/revaid/ingestion/pipeline.py","line":212,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/ingestion/pipeline.py:212"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_writable\" a function or an attribute? If it is a function, you may have meant i.is_writable() because i.is_writable is always true.","path":"backend/src/revaid/repositories/data_items.py","line":94,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/repositories/data_items.py:94"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant Function.is_entry_point() because Function.is_entry_point is always true.","path":"backend/src/revaid/repositories/functions.py","line":498,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/repositories/functions.py:498"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility_effective\" a function or an attribute? If it is a function, you may have meant Function.is_utility_effective() because Function.is_utility_effective is always true.","path":"backend/src/revaid/repositories/neighbours.py","line":134,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/repositories/neighbours.py:134"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility_effective\" a function or an attribute? If it is a function, you may have meant Function.is_utility_effective() because Function.is_utility_effective is always true.","path":"backend/src/revaid/repositories/neighbours.py","line":141,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/repositories/neighbours.py:141"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility_effective\" a function or an attribute? If it is a function, you may have meant Function.is_utility_effective() because Function.is_utility_effective is always true.","path":"backend/src/revaid/repositories/neighbours.py","line":163,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/repositories/neighbours.py:163"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility_effective\" a function or an attribute? If it is a function, you may have meant fn.is_utility_effective() because fn.is_utility_effective is always true.","path":"backend/src/revaid/schemas/function.py","line":88,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/schemas/function.py:88"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant fn.is_entry_point() because fn.is_entry_point is always true.","path":"backend/src/revaid/schemas/function.py","line":91,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/schemas/function.py:91"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant base.is_entry_point() because base.is_entry_point is always true.","path":"backend/src/revaid/schemas/mcp.py","line":236,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/schemas/mcp.py:236"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_writable\" a function or an attribute? If it is a function, you may have meant item.is_writable() because item.is_writable is always true.","path":"backend/src/revaid/schemas/mcp.py","line":363,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/schemas/mcp.py:363"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility_effective\" a function or an attribute? If it is a function, you may have meant fn.is_utility_effective() because fn.is_utility_effective is always true.","path":"backend/src/revaid/schemas/search.py","line":36,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/schemas/search.py:36"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_entry_point\" a function or an attribute? If it is a function, you may have meant fn.is_entry_point() because fn.is_entry_point is always true.","path":"backend/src/revaid/schemas/search.py","line":39,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid/schemas/search.py:39"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/src/revaid/summarization/queue.py","line":63,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/src/revaid/summarization/queue.py:63"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/src/revaid_contracts/events.py","line":52,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/src/revaid_contracts/events.py:52"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_renamed\" a function or an attribute? If it is a function, you may have meant row.is_renamed() because row.is_renamed is always true.","path":"backend/src/revaid_ui/services/neighbour_service.py","line":80,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid_ui/services/neighbour_service.py:80"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_utility\" a function or an attribute? If it is a function, you may have meant row.is_utility() because row.is_utility is always true.","path":"backend/src/revaid_ui/services/neighbour_service.py","line":86,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid_ui/services/neighbour_service.py:86"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_self\" a function or an attribute? If it is a function, you may have meant row.is_self() because row.is_self is always true.","path":"backend/src/revaid_ui/services/neighbour_service.py","line":89,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/src/revaid_ui/services/neighbour_service.py:89"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/features/neighbours/NeighbourTable.tsx","line":103,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/features/neighbours/NeighbourTable.tsx:103"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/features/neighbours/UtilityGroup.tsx","line":122,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/features/neighbours/UtilityGroup.tsx:122"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/features/search/FunctionSearchDialog.tsx","line":75,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/features/search/FunctionSearchDialog.tsx:75"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/features/sidebar/Sidebar.tsx","line":123,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/features/sidebar/Sidebar.tsx:123"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/features/sidebar/Sidebar.tsx","line":124,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/features/sidebar/Sidebar.tsx:124"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/features/sidebar/Sidebar.tsx","line":125,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/features/sidebar/Sidebar.tsx:125"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/hooks/useDebouncedValue.ts","line":8,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/hooks/useDebouncedValue.ts:8"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":16363.0,"source_lines":29362.0,"test_ratio":0.5573,"ci_files":1.0,"cochange_share":0.6765,"cochange_commits":136.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest, npm run test, vitest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff, mypy, eslint)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest","npm run test","vitest"],"lint_commands":["ruff","mypy","eslint"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":119.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":75.0,"escapes_per_kloc":2.634},"findings":[],"evidence":[{"kind":"typing","description":"Python strict type checking: backend/pyproject.toml","ref":"backend/pyproject.toml","url":null,"weight":0.0},{"kind":"typing","description":"TypeScript strict type checking: frontend/tsconfig.app.json","ref":"frontend/tsconfig.app.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}