{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:51:06.494293Z","repo":{"ref":{"host":"github.com","owner":"dollspace-gay","name":"proto-blue"},"default_branch":"main","clone_url":"https://github.com/dollspace-gay/proto-blue.git","html_url":"https://github.com/dollspace-gay/proto-blue","description":null,"stars":11,"forks":1,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2152,"primary_language":"Rust","license_spdx":null,"created_at":"2026-02-06T19:10:06Z","pushed_at":"2026-11-08T00:34:41Z","security_policy_url":null,"distribution":{"owner_created_at":"2024-12-01T21:26:56Z","owner_type":"User","release_assets":[]}},"commit_sha":"52d4b2b37fc8fb137efa62040c4d5d085d522fa6","profile":{"lines_by_language":{"Rust":79459,"JavaScript":449,"Shell":30},"files_by_category":{"source":494,"config":359,"docs":72,"test":29,"other":3,"generated":3},"source_lines":72166,"test_lines":7772},"pillars":{"ai_provenance":{"score":67.4,"confidence":0.93,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.6741,"suspected_share":0.0,"estimated_share":0.6741,"ai_artifacts":0.0,"flagged_work_units":2.0,"flagged_releases":null},"summary":"Explicit AI attribution on 67% of first-party code added; an estimated 67% including velocity signals."},"quality":{"score":70.5,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":85.0,"duplication":12.2,"lint":100.0,"testing":80.4,"docs":60.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.11, CI runs tests; 5% of function code in complex or long functions; 35% duplicated lines. Weakest area: duplication."},"security":{"score":44.0,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":45.7,"sast":100.0,"dependencies":30.6,"ci_actions":0.6,"posture":20.0,"scorecard":null},"summary":"Security posture is poor: 1 possible secret(s) in the tree, 0 only in history; 47 known vulnerabilities in 17 dependencies; 23 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":48.0,"checked":48.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":93.0,"attributed_commits":70.0,"attributed_commit_share":0.7526881720430108,"effective_loc":88557.0,"attributed_loc":59697.0,"attributed_loc_share":0.6741082014973407,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 70 attributed commits, 59,697 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"579761684257c794c07b366b06d5bb269a027c17","url":"https://github.com/dollspace-gay/proto-blue/commit/579761684257c794c07b366b06d5bb269a027c17","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"14f82459290af61a00a3511bcefd97b39e152fd0","url":"https://github.com/dollspace-gay/proto-blue/commit/14f82459290af61a00a3511bcefd97b39e152fd0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5bc0a9372a9383f8046a54037867342e5b832e2b","url":"https://github.com/dollspace-gay/proto-blue/commit/5bc0a9372a9383f8046a54037867342e5b832e2b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e36a5fa981ddcf89e45fcb6484f5eebb3b52ccf4","url":"https://github.com/dollspace-gay/proto-blue/commit/e36a5fa981ddcf89e45fcb6484f5eebb3b52ccf4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"eeb694630fc2cfeaf80a14ec1d38df89c3ff8b1a","url":"https://github.com/dollspace-gay/proto-blue/commit/eeb694630fc2cfeaf80a14ec1d38df89c3ff8b1a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4a704317b1fee2c55b7b815a8f4742b9b74b333e","url":"https://github.com/dollspace-gay/proto-blue/commit/4a704317b1fee2c55b7b815a8f4742b9b74b333e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"30be5d487be0f3b09e6c9aeac246942fc04b5c12","url":"https://github.com/dollspace-gay/proto-blue/commit/30be5d487be0f3b09e6c9aeac246942fc04b5c12","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9c539a5402843eef9d92ad5dabf19f979b11143d","url":"https://github.com/dollspace-gay/proto-blue/commit/9c539a5402843eef9d92ad5dabf19f979b11143d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a21c555cee607bd560fef56c907de2e42ff10237","url":"https://github.com/dollspace-gay/proto-blue/commit/a21c555cee607bd560fef56c907de2e42ff10237","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a6d1f67b14991cf2c59ac851a7be5c4e31a426d4","url":"https://github.com/dollspace-gay/proto-blue/commit/a6d1f67b14991cf2c59ac851a7be5c4e31a426d4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1a80d19f8960c6826b0f9923449c8400421a474b","url":"https://github.com/dollspace-gay/proto-blue/commit/1a80d19f8960c6826b0f9923449c8400421a474b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"dd1db41dd2a9a05463105f5b8fb0c841d18050e6","url":"https://github.com/dollspace-gay/proto-blue/commit/dd1db41dd2a9a05463105f5b8fb0c841d18050e6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7455b348c9bd2e93af0b43f03b92f5cb2d4d8ef4","url":"https://github.com/dollspace-gay/proto-blue/commit/7455b348c9bd2e93af0b43f03b92f5cb2d4d8ef4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"318b06927b75c28660c6b1e6a26bc0bec058f90a","url":"https://github.com/dollspace-gay/proto-blue/commit/318b06927b75c28660c6b1e6a26bc0bec058f90a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"27fd59a26f322484d29da75ca3588013a4bed734","url":"https://github.com/dollspace-gay/proto-blue/commit/27fd59a26f322484d29da75ca3588013a4bed734","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c8acc1baa3017a205cc420cf58a4c5be8673fd39","url":"https://github.com/dollspace-gay/proto-blue/commit/c8acc1baa3017a205cc420cf58a4c5be8673fd39","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9bc4e51063c8444ad989d23298be043b7c5a3919","url":"https://github.com/dollspace-gay/proto-blue/commit/9bc4e51063c8444ad989d23298be043b7c5a3919","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bdcf9e43e9f1d4a116c1acd6e81e34fcc9c1008e","url":"https://github.com/dollspace-gay/proto-blue/commit/bdcf9e43e9f1d4a116c1acd6e81e34fcc9c1008e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3f1b22dabf561818bbac6288de18ce0e31237b3a","url":"https://github.com/dollspace-gay/proto-blue/commit/3f1b22dabf561818bbac6288de18ce0e31237b3a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"fd91a50898dc98859ffa2a8f49d7cbba11952f32","url":"https://github.com/dollspace-gay/proto-blue/commit/fd91a50898dc98859ffa2a8f49d7cbba11952f32","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e5dfe62d43936b6cd7f2afafe3420796f5b1aecb","url":"https://github.com/dollspace-gay/proto-blue/commit/e5dfe62d43936b6cd7f2afafe3420796f5b1aecb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"50a873da28ff5bf6a131ef9a0ad4598e6a819366","url":"https://github.com/dollspace-gay/proto-blue/commit/50a873da28ff5bf6a131ef9a0ad4598e6a819366","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3e5ff1a108d5c73c0498aade8a0a8fb8635800c4","url":"https://github.com/dollspace-gay/proto-blue/commit/3e5ff1a108d5c73c0498aade8a0a8fb8635800c4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a1b08db452e71570c59aa64b912fe756dab0de7d","url":"https://github.com/dollspace-gay/proto-blue/commit/a1b08db452e71570c59aa64b912fe756dab0de7d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"69c61de4f2fb3b7f41abed460071d1b09859f482","url":"https://github.com/dollspace-gay/proto-blue/commit/69c61de4f2fb3b7f41abed460071d1b09859f482","weight":0.9}],"data":{"attributed_loc_by_commit":{"4dc10d449ec09dd15311cefb1bc10e7d8ed91024":0,"7e467eb7d6d3857ac4c066a56076515804c118fe":195,"a099b59a8fcb40e4de4240a3f8afb0f891a5d5cf":0,"1de3741a690ff5d4a91a81194108b8b965bb29f6":0,"17d2abc5ed4474d264df48c2fed7e3c2f492d861":8,"840c66584e7e53eee0b1b443adb9dd2d2fa75641":0,"4b48e250c701df0297d73f5a2e7c59ff727bf16f":0,"a656d0a863b509d0aad244f005b0aeaa0b4ba547":0,"75dc807cc1b164f4b28a1d8754f7ccca9130d031":0,"26527e2e0e0d52c9f2f80e16013cb42faa2d0f08":55,"05514bbf4a10342e83eb1b97c372b741dc701144":2007,"8c9d38df6ba44be214275c9b29fc0682e4221e51":9190,"fb64c8362b60b890cd139b96dad155b23734853d":3,"c1fa4ec3cad05cf90096b26e924be771e14c69d7":0,"3ea8cbbe10f3848422ebe46e01b69e3c966c90c7":0,"309deb3e89bf3fb62a5950a895984d16bc61e007":41,"91fa6bc1b147fca5f48fe1f59cab23bf4ea128d5":0,"00118936add3cdf5723c7d378be49365e57a50c0":668,"fdca1e1f0e74c0fb14f57114984a3c831cf763ee":259,"b193e5bc7c7aa6dcad71cf8ec60133fc776ddbc6":397,"5dcd6798675a29a93fe80bc0bd0fb055a5a9a7ac":269,"3afeb9cf7e1ad551b1e834982d8ed57782b115ab":14,"4237a878d6a02457d465551c27d2e976a1bebe6e":250,"03e5f5167b6eaea8fc32ab28212f8fe4214f1d83":200,"6e887d00eee986dd4070f7d380a2a7a30d7aa6a2":380,"508bd212fc670634e33e77262799740504b95017":145,"12ebedd5b29f18906701f17ac709ad13417e75eb":265,"41cf7a1a9cb9965d3a0f1d99d9f41ce1226ac3ae":845,"1bbc7cb6c3b2e6f0d0e12ce5da1a187c530666af":722,"7f76027a0b7227cdacd08e4b6129efd209a11122":354,"6273460e2dfa236bd5c19a3100bb7d9d40f9cd7a":522,"cd6bf8cd46b3b61001971c3ff4f665556570ba27":487,"5f6d03c1234c7a4bd7f9fc0a54ce608c134faad2":292,"a48d61a2843f34b7225ec4383f15f3eddf9bdc75":126,"aae25a82d12669178bca28860e544e74d14ebc95":281,"2f02a51f55816c9e6d288fee99e73dfbb7d8dc97":178,"b8cd1aa1dcb6d1211ff67b8b4f483d4bc1cb7a2f":194,"974f7c4d10c38d4c104530d4409b92178b232079":444,"a41218becb497abd242bc008f2d1bcbdb809df26":9512,"0d48361a57d7b9e22f4b818360a89f784451152d":386,"182984c57a85c78cc9c6579873c5b0b849f6575a":391,"9769b1acf6e45dd6387d20f0be25f03b5b70cb2b":827,"0db4703c987587c585c2ded37f5ea3b36eb77177":515,"26d8c3d11a85f2bb2726c6c705fd598a1de04f6c":79,"3c4266f628b4a6c87c68c00506167777c486b66e":7732,"69c61de4f2fb3b7f41abed460071d1b09859f482":324,"a1b08db452e71570c59aa64b912fe756dab0de7d":694,"3e5ff1a108d5c73c0498aade8a0a8fb8635800c4":402,"50a873da28ff5bf6a131ef9a0ad4598e6a819366":0,"e5dfe62d43936b6cd7f2afafe3420796f5b1aecb":0,"fd91a50898dc98859ffa2a8f49d7cbba11952f32":8800,"3f1b22dabf561818bbac6288de18ce0e31237b3a":110,"bdcf9e43e9f1d4a116c1acd6e81e34fcc9c1008e":151,"9bc4e51063c8444ad989d23298be043b7c5a3919":271,"c8acc1baa3017a205cc420cf58a4c5be8673fd39":1255,"27fd59a26f322484d29da75ca3588013a4bed734":0,"318b06927b75c28660c6b1e6a26bc0bec058f90a":343,"7455b348c9bd2e93af0b43f03b92f5cb2d4d8ef4":405,"dd1db41dd2a9a05463105f5b8fb0c841d18050e6":536,"1a80d19f8960c6826b0f9923449c8400421a474b":413,"a6d1f67b14991cf2c59ac851a7be5c4e31a426d4":150,"a21c555cee607bd560fef56c907de2e42ff10237":97,"9c539a5402843eef9d92ad5dabf19f979b11143d":0,"30be5d487be0f3b09e6c9aeac246942fc04b5c12":514,"4a704317b1fee2c55b7b815a8f4742b9b74b333e":4585,"eeb694630fc2cfeaf80a14ec1d38df89c3ff8b1a":937,"e36a5fa981ddcf89e45fcb6484f5eebb3b52ccf4":1202,"5bc0a9372a9383f8046a54037867342e5b832e2b":0,"14f82459290af61a00a3511bcefd97b39e152fd0":235,"579761684257c794c07b366b06d5bb269a027c17":40},"tools":{"claude-code":{"name":"Claude Code","commits":70,"loc":59697,"first_seen":1773003278,"last_seen":1779079811}},"monthly":{"2026-02":{"loc":27326,"attributed_loc":0},"2026-03":{"loc":2265,"attributed_loc":2265},"2026-04":{"loc":50434,"attributed_loc":50433},"2026-05":{"loc":7206,"attributed_loc":6999},"2026-10":{"loc":120,"attributed_loc":0},"2026-11":{"loc":1206,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":19.0,"flagged_units":2.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":21753.0,"flagged_loc":12738.0,"flagged_loc_share":0.5855744035305475,"max_loc_per_hour":1361.1711493975074,"median_loc_per_hour":265.25,"pr_timed_units":0.0,"excluded_import_loc":66804.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"10,951 lines of first-party code in ~8.0h (1,361 lines/hour, 30 commit session)","ref":"3e5ff1a108d5c73c0498aade8a0a8fb8635800c4","url":"https://github.com/dollspace-gay/proto-blue/commit/3e5ff1a108d5c73c0498aade8a0a8fb8635800c4","weight":0.4083513448192522},{"kind":"velocity-burst","description":"1,787 lines of first-party code in ~2.3h (761 lines/hour, 4 commit session)","ref":"c8acc1baa3017a205cc420cf58a4c5be8673fd39","url":"https://github.com/dollspace-gay/proto-blue/commit/c8acc1baa3017a205cc420cf58a4c5be8673fd39","weight":0.2282355723746452}],"data":{"flagged_loc_by_commit":{"309deb3e89bf3fb62a5950a895984d16bc61e007":41,"00118936add3cdf5723c7d378be49365e57a50c0":668,"fdca1e1f0e74c0fb14f57114984a3c831cf763ee":259,"b193e5bc7c7aa6dcad71cf8ec60133fc776ddbc6":397,"5dcd6798675a29a93fe80bc0bd0fb055a5a9a7ac":269,"3afeb9cf7e1ad551b1e834982d8ed57782b115ab":14,"4237a878d6a02457d465551c27d2e976a1bebe6e":250,"03e5f5167b6eaea8fc32ab28212f8fe4214f1d83":200,"6e887d00eee986dd4070f7d380a2a7a30d7aa6a2":380,"508bd212fc670634e33e77262799740504b95017":145,"12ebedd5b29f18906701f17ac709ad13417e75eb":265,"41cf7a1a9cb9965d3a0f1d99d9f41ce1226ac3ae":845,"1bbc7cb6c3b2e6f0d0e12ce5da1a187c530666af":722,"7f76027a0b7227cdacd08e4b6129efd209a11122":354,"6273460e2dfa236bd5c19a3100bb7d9d40f9cd7a":522,"cd6bf8cd46b3b61001971c3ff4f665556570ba27":487,"5f6d03c1234c7a4bd7f9fc0a54ce608c134faad2":292,"a48d61a2843f34b7225ec4383f15f3eddf9bdc75":126,"aae25a82d12669178bca28860e544e74d14ebc95":281,"2f02a51f55816c9e6d288fee99e73dfbb7d8dc97":178,"b8cd1aa1dcb6d1211ff67b8b4f483d4bc1cb7a2f":194,"974f7c4d10c38d4c104530d4409b92178b232079":444,"0d48361a57d7b9e22f4b818360a89f784451152d":386,"182984c57a85c78cc9c6579873c5b0b849f6575a":391,"9769b1acf6e45dd6387d20f0be25f03b5b70cb2b":827,"0db4703c987587c585c2ded37f5ea3b36eb77177":515,"26d8c3d11a85f2bb2726c6c705fd598a1de04f6c":79,"69c61de4f2fb3b7f41abed460071d1b09859f482":324,"a1b08db452e71570c59aa64b912fe756dab0de7d":694,"3e5ff1a108d5c73c0498aade8a0a8fb8635800c4":402,"3f1b22dabf561818bbac6288de18ce0e31237b3a":110,"bdcf9e43e9f1d4a116c1acd6e81e34fcc9c1008e":151,"9bc4e51063c8444ad989d23298be043b7c5a3919":271,"c8acc1baa3017a205cc420cf58a4c5be8673fd39":1255},"excluded_import_commits":["307233d6b7f2e0fcb1d74f6bff6b8ba2ce3d4e14","3c4266f628b4a6c87c68c00506167777c486b66e","4a704317b1fee2c55b7b815a8f4742b9b74b333e","8c9d38df6ba44be214275c9b29fc0682e4221e51","a41218becb497abd242bc008f2d1bcbdb809df26","fd91a50898dc98859ffa2a8f49d7cbba11952f32"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":72166.0,"index":0.125,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":14.0,"per_kloc:emoji_in_code":0.194,"files:emoji_in_code":5.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.014,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:assistant_voice","description":"assistant-style phrasing left in code: /// A repository parsed from a CAR file and verified (as requested).","ref":"proto-blue/crates/proto-blue-repo/src/sync.rs:30","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-repo/src/sync.rs#L30","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":1.0,"secrets_history":0.0,"secrets_nonprod":5.0,"secrets_low_confidence":6.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"proto-blue/crates/proto-blue-identity/src/types.rs","line":75,"fingerprint":"proto-blue/crates/proto-blue-identity/src/types.rs:generic-api-key:75"},{"rule_id":"gitleaks/jwt","severity":"high","message":"Possible jwt secret in the current tree","path":"proto-blue/crates/proto-blue-common/src/obfuscate.rs","line":243,"fingerprint":"proto-blue/crates/proto-blue-common/src/obfuscate.rs:jwt:243"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"proto-blue/crates/proto-blue-interop-tests/tests/differential.rs","line":480,"fingerprint":"proto-blue/crates/proto-blue-interop-tests/tests/differential.rs:generic-api-key:480"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"proto-blue/crates/proto-blue-identity/src/did.rs","line":588,"fingerprint":"proto-blue/crates/proto-blue-identity/src/did.rs:generic-api-key:588"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"proto-blue/interop-test-files/crypto/w3c_didkey_P256.json","line":3,"fingerprint":"proto-blue/interop-test-files/crypto/w3c_didkey_P256.json:generic-api-key:3"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"proto-blue/interop-test-files/syntax/did_syntax_valid.txt","line":25,"fingerprint":"proto-blue/interop-test-files/syntax/did_syntax_valid.txt:generic-api-key:25"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"proto-blue/interop-test-files/crypto/signature-fixtures.json","line":7,"fingerprint":"proto-blue/interop-test-files/crypto/signature-fixtures.json:generic-api-key:7"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"proto-blue/interop-test-files/crypto/w3c_didkey_K256.json","line":3,"fingerprint":"proto-blue/interop-test-files/crypto/w3c_didkey_K256.json:generic-api-key:3"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 307233d6b7); removed from the current tree but still retrievable","path":"atproto-rs/interop-test-files/crypto/w3c_didkey_P256.json","line":3,"fingerprint":"307233d6b7f2e0fcb1d74f6bff6b8ba2ce3d4e14:atproto-rs/interop-test-files/crypto/w3c_didkey_P256.json:generic-api-key:3"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 307233d6b7); removed from the current tree but still retrievable","path":"atproto-rs/interop-test-files/syntax/did_syntax_valid.txt","line":25,"fingerprint":"307233d6b7f2e0fcb1d74f6bff6b8ba2ce3d4e14:atproto-rs/interop-test-files/syntax/did_syntax_valid.txt:generic-api-key:25"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 307233d6b7); removed from the current tree but still retrievable","path":"atproto-rs/interop-test-files/crypto/w3c_didkey_K256.json","line":3,"fingerprint":"307233d6b7f2e0fcb1d74f6bff6b8ba2ce3d4e14:atproto-rs/interop-test-files/crypto/w3c_didkey_K256.json:generic-api-key:3"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 307233d6b7); removed from the current tree but still retrievable","path":"atproto-rs/interop-test-files/crypto/signature-fixtures.json","line":7,"fingerprint":"307233d6b7f2e0fcb1d74f6bff6b8ba2ce3d4e14:atproto-rs/interop-test-files/crypto/signature-fixtures.json:generic-api-key:7"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":72166.0,"parse_errors":0.0},"findings":[],"evidence":[],"data":{"rulesets":["rust","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":17.0,"vulnerabilities":47.0,"vulns_critical":0.0,"vulns_high":6.0,"vulns_medium":9.0,"vulns_low":4.0,"vulns_unknown":28.0,"penalty":71.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0509","severity":"high","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0509","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0509"},{"rule_id":"osv/GHSA-6w6g-hm98-mhgm","severity":"high","message":"hickory-resolver@0.26.1 (crates.io) is affected by RUSTSEC-2026-0513, GHSA-6w6g-hm98-mhgm","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-resolver@0.26.1 (crates.io):GHSA-6w6g-hm98-mhgm"},{"rule_id":"osv/GHSA-5j98-2g5x-46v6","severity":"high","message":"hickory-resolver@0.26.1 (crates.io) is affected by RUSTSEC-2026-0514, GHSA-5j98-2g5x-46v6","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-resolver@0.26.1 (crates.io):GHSA-5j98-2g5x-46v6"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"proto-blue/crates/proto-blue-interop-tests/ts-runner/package-lock.json","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-4w2j-m93h-cj5j","severity":"high","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0185, GHSA-4w2j-m93h-cj5j","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):GHSA-4w2j-m93h-cj5j"},{"rule_id":"osv/RUSTSEC-2026-0340","severity":"high","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0340","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0340"},{"rule_id":"osv/RUSTSEC-2026-0190","severity":"medium","message":"anyhow@1.0.102 (crates.io) is affected by RUSTSEC-2026-0190; also in proto-blue/scripts/wildscrape/Cargo.lock","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"anyhow@1.0.102 (crates.io):RUSTSEC-2026-0190"},{"rule_id":"osv/RUSTSEC-2026-0204","severity":"medium","message":"crossbeam-epoch@0.9.18 (crates.io) is affected by RUSTSEC-2026-0204","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"crossbeam-epoch@0.9.18 (crates.io):RUSTSEC-2026-0204"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.4.13 (crates.io) is affected by RUSTSEC-2026-0258","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"h2@0.4.13 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2026-0506","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0506","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0506"},{"rule_id":"osv/RUSTSEC-2026-0507","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0507","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0507"},{"rule_id":"osv/RUSTSEC-2026-0508","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0508","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0508"},{"rule_id":"osv/RUSTSEC-2026-0517","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0517","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0517"},{"rule_id":"osv/RUSTSEC-2026-0518","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0518","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0518"},{"rule_id":"osv/RUSTSEC-2026-0519","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0519","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0519"},{"rule_id":"osv/RUSTSEC-2026-0520","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0520","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0520"},{"rule_id":"osv/RUSTSEC-2026-0539","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0539","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0539"},{"rule_id":"osv/RUSTSEC-2026-0540","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0540","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0540"},{"rule_id":"osv/RUSTSEC-2026-0541","severity":"medium","message":"hickory-net@0.26.1 (crates.io) is affected by RUSTSEC-2026-0541","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-net@0.26.1 (crates.io):RUSTSEC-2026-0541"},{"rule_id":"osv/RUSTSEC-2026-0487","severity":"medium","message":"hickory-proto@0.26.1 (crates.io) is affected by RUSTSEC-2026-0487","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-proto@0.26.1 (crates.io):RUSTSEC-2026-0487"},{"rule_id":"osv/RUSTSEC-2026-0488","severity":"medium","message":"hickory-proto@0.26.1 (crates.io) is affected by RUSTSEC-2026-0488","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-proto@0.26.1 (crates.io):RUSTSEC-2026-0488"},{"rule_id":"osv/RUSTSEC-2026-0489","severity":"medium","message":"hickory-proto@0.26.1 (crates.io) is affected by RUSTSEC-2026-0489","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-proto@0.26.1 (crates.io):RUSTSEC-2026-0489"},{"rule_id":"osv/RUSTSEC-2026-0490","severity":"medium","message":"hickory-proto@0.26.1 (crates.io) is affected by RUSTSEC-2026-0490","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-proto@0.26.1 (crates.io):RUSTSEC-2026-0490"},{"rule_id":"osv/RUSTSEC-2026-0491","severity":"medium","message":"hickory-proto@0.26.1 (crates.io) is affected by RUSTSEC-2026-0491","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-proto@0.26.1 (crates.io):RUSTSEC-2026-0491"},{"rule_id":"osv/RUSTSEC-2026-0515","severity":"medium","message":"hickory-resolver@0.26.1 (crates.io) is affected by RUSTSEC-2026-0515","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-resolver@0.26.1 (crates.io):RUSTSEC-2026-0515"},{"rule_id":"osv/RUSTSEC-2026-0516","severity":"medium","message":"hickory-resolver@0.26.1 (crates.io) is affected by RUSTSEC-2026-0516","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-resolver@0.26.1 (crates.io):RUSTSEC-2026-0516"},{"rule_id":"osv/GHSA-6f2x-v7q7-m7m5","severity":"medium","message":"hickory-resolver@0.26.1 (crates.io) is affected by GHSA-6f2x-v7q7-m7m5","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"hickory-resolver@0.26.1 (crates.io):GHSA-6f2x-v7q7-m7m5"},{"rule_id":"osv/GHSA-phqj-4mhp-q6mq","severity":"medium","message":"openssl@0.10.79 (crates.io) is affected by RUSTSEC-2026-0477, GHSA-phqj-4mhp-q6mq","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"openssl@0.10.79 (crates.io):GHSA-phqj-4mhp-q6mq"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.38 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"rustls@0.23.38 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.38 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"rustls@0.23.38 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.13 (crates.io) is affected by RUSTSEC-2026-0382; also in proto-blue/scripts/wildscrape/Cargo.lock","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.13 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.52.1 (crates.io) is affected by RUSTSEC-2026-0386","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"tokio@1.52.1 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0381","severity":"medium","message":"webpki-roots@1.0.7 (crates.io) is affected by RUSTSEC-2026-0381; also in proto-blue/scripts/wildscrape/Cargo.lock","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"webpki-roots@1.0.7 (crates.io):RUSTSEC-2026-0381"},{"rule_id":"osv/RUSTSEC-2026-0338","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0338","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0338"},{"rule_id":"osv/RUSTSEC-2026-0339","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0339","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0339"},{"rule_id":"osv/RUSTSEC-2026-0342","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0342","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0342"},{"rule_id":"osv/RUSTSEC-2026-0523","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0523","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0523"},{"rule_id":"osv/RUSTSEC-2026-0524","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0524","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0524"},{"rule_id":"osv/RUSTSEC-2026-0538","severity":"medium","message":"quinn-udp@0.5.14 (crates.io) is affected by RUSTSEC-2026-0538","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"quinn-udp@0.5.14 (crates.io):RUSTSEC-2026-0538"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.52.3 (crates.io) is affected by RUSTSEC-2026-0386","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"tokio@1.52.3 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.38 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"rustls@0.23.38 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.38 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"proto-blue/Cargo.lock","line":null,"fingerprint":"rustls@0.23.38 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"proto-blue/scripts/wildscrape/Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-w44r-93j7-qv28"}],"evidence":[],"data":{"ecosystems":["crates.io","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":4.0,"findings":38.0,"findings_high":23.0,"findings_medium":15.0,"findings_low":0.0,"penalty":303.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":42,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:42"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":46,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:46"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":102,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:102"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":103,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:103"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":104,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:104"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":115,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:115"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":116,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:116"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":117,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:117"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:47"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":49,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":50,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:50"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":68,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:68"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/interop.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/interop.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/interop.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/interop.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/interop.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/interop.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/interop.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/interop.yml:35"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/live-pds.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/live-pds.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/live-pds.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/live-pds.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/live-pds.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/live-pds.yml:31"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":22,"fingerprint":"artipacked:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":42,"fingerprint":"artipacked:.github/workflows/ci.yml:42"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":102,"fingerprint":"artipacked:.github/workflows/ci.yml:102"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":115,"fingerprint":"artipacked:.github/workflows/ci.yml:115"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":18,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:18"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":38,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:38"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":94,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:94"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":111,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:111"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/fuzz.yml","line":47,"fingerprint":"artipacked:.github/workflows/fuzz.yml:47"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/fuzz.yml","line":28,"fingerprint":"excessive-permissions:.github/workflows/fuzz.yml:28"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/interop.yml","line":29,"fingerprint":"artipacked:.github/workflows/interop.yml:29"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/interop.yml","line":25,"fingerprint":"excessive-permissions:.github/workflows/interop.yml:25"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/live-pds.yml","line":29,"fingerprint":"artipacked:.github/workflows/live-pds.yml:29"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/live-pds.yml","line":22,"fingerprint":"excessive-permissions:.github/workflows/live-pds.yml:22"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.957,"unpinned_manifests":17.0},"findings":[],"evidence":[{"kind":"posture","description":"proto-blue/crates/proto-blue-api/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-api/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-codegen/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-codegen/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-common/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-common/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-crypto/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-crypto/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-identity/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-identity/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-interop-tests/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-interop-tests/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-lex-cbor/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-lex-cbor/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-lex-data/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-lex-data/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-lex-json/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-lex-json/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-lexicon/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-lexicon/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-oauth/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-oauth/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-repo/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-repo/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-syntax/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-syntax/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-ws/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-ws/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue-xrpc/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue-xrpc/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/crates/proto-blue/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/crates/proto-blue/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"proto-blue/fuzz/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"proto-blue/fuzz/Cargo.toml","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2923.0,"function_nloc":39618.0,"mean_ccn":2.67,"p90_ccn":6.0,"complex_functions":21.0,"long_functions":7.0,"many_param_functions":0.0,"risky_nloc_share":0.0543},"findings":[],"evidence":[{"kind":"complex-function","description":"dispatch in proto-blue/crates/proto-blue-interop-tests/ts-runner/index.mjs: complexity 44, 149 lines","ref":"proto-blue/crates/proto-blue-interop-tests/ts-runner/index.mjs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-interop-tests/ts-runner/index.mjs#L146","weight":0.7333333333333333},{"kind":"complex-function","description":"to_query_params in proto-blue/crates/proto-blue-api/src/generated/tools/ozone/moderation/queryStatuses.rs: complexity 37, 240 lines","ref":"proto-blue/crates/proto-blue-api/src/generated/tools/ozone/moderation/queryStatuses.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/tools/ozone/moderation/queryStatuses.rs#L109","weight":0.6166666666666667},{"kind":"complex-function","description":"resolve_refs in proto-blue/crates/proto-blue-lexicon/src/lexicons.rs: complexity 26, 67 lines","ref":"proto-blue/crates/proto-blue-lexicon/src/lexicons.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-lexicon/src/lexicons.rs#L461","weight":0.43333333333333335},{"kind":"complex-function","description":"lexValueJsonToIpld in proto-blue/crates/proto-blue-interop-tests/ts-runner/index.mjs: complexity 25, 57 lines","ref":"proto-blue/crates/proto-blue-interop-tests/ts-runner/index.mjs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-interop-tests/ts-runner/index.mjs#L355","weight":0.4166666666666667},{"kind":"complex-function","description":"to_query_params in proto-blue/crates/proto-blue-api/src/generated/tools/ozone/moderation/queryEvents.rs: complexity 24, 178 lines","ref":"proto-blue/crates/proto-blue-api/src/generated/tools/ozone/moderation/queryEvents.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/tools/ozone/moderation/queryEvents.rs#L83","weight":0.4},{"kind":"complex-function","description":"ui in proto-blue/crates/proto-blue-api/src/moderation/decision.rs: complexity 23, 87 lines","ref":"proto-blue/crates/proto-blue-api/src/moderation/decision.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/moderation/decision.rs#L144","weight":0.38333333333333336},{"kind":"complex-function","description":"add in proto-blue/crates/proto-blue-repo/src/mst/lazy.rs: complexity 22, 88 lines","ref":"proto-blue/crates/proto-blue-repo/src/mst/lazy.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-repo/src/mst/lazy.rs#L503","weight":0.36666666666666664},{"kind":"complex-function","description":"cbor_to_lex in proto-blue/crates/proto-blue-lex-cbor/src/encoding.rs: complexity 21, 55 lines","ref":"proto-blue/crates/proto-blue-lex-cbor/src/encoding.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-lex-cbor/src/encoding.rs#L196","weight":0.35},{"kind":"complex-function","description":"check_required_properties in proto-blue/crates/proto-blue-lexicon/src/lexicons.rs: complexity 21, 45 lines","ref":"proto-blue/crates/proto-blue-lexicon/src/lexicons.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-lexicon/src/lexicons.rs#L328","weight":0.35},{"kind":"complex-function","description":"decode_node in proto-blue/crates/proto-blue-repo/src/mst/lazy.rs: complexity 21, 84 lines","ref":"proto-blue/crates/proto-blue-repo/src/mst/lazy.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-repo/src/mst/lazy.rs#L294","weight":0.35}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":53711.0,"duplicated_lines":18848.0,"duplicated_share":0.3509,"files":494.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/agent.rs:147 and proto-blue/crates/proto-blue-api/src/agent.rs:1231","ref":"proto-blue/crates/proto-blue-api/src/agent.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/agent.rs#L147","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs:157 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/draft/defs.rs:10","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs#L157","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs:233 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs:264","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs#L233","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs:272 and proto-blue/crates/proto-blue-api/src/generated/chat/bsky/actor/defs.rs:16","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs#L272","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs:362 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/embed/recordWithMedia.rs:34","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/defs.rs#L362","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs:12 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/putPreferences.rs:12","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs:15 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfile.rs:17","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs:21 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/ageassurance/getConfig.rs:15","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getPreferences.rs#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfile.rs:23 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfiles.rs:27","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfile.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfile.rs#L23","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfile.rs:25 and proto-blue/crates/proto-blue-api/src/generated/app/bsky/feed/getActorFeeds.rs:35","ref":"proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfile.rs","url":"https://github.com/dollspace-gay/proto-blue/blob/52d4b2b37fc8fb137efa62040c4d5d085d522fa6/proto-blue/crates/proto-blue-api/src/generated/app/bsky/actor/getProfile.rs#L25","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":72166.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2154,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":7772.0,"source_lines":72166.0,"test_ratio":0.1077,"ci_files":4.0,"cochange_share":0.3939,"cochange_commits":66.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/fuzz.yml","ref":".github/workflows/fuzz.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/interop.yml","ref":".github/workflows/interop.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/live-pds.yml","ref":".github/workflows/live-pds.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test, cargo test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (clippy, rustfmt, cargo fmt)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test","cargo test"],"lint_commands":["clippy","rustfmt","cargo fmt"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":290.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":47745.0,"other_lines":24421.0,"files_blamed":494.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":3.0,"security:ai_per_kloc":0.063,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}