{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:04.051922Z","repo":{"ref":{"host":"github.com","owner":"dougwithseismic","name":"claude-does-apoc"},"default_branch":"main","clone_url":"https://github.com/dougwithseismic/claude-does-apoc.git","html_url":"https://github.com/dougwithseismic/claude-does-apoc","description":"Android Phone Orchestration & Control - Built entirely by Claude","stars":3,"forks":1,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":468,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2025-12-16T20:51:16Z","pushed_at":"2025-12-17T16:59:17Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-03-13T18:53:56Z","owner_type":"User","release_assets":[]}},"commit_sha":"b1387ef1de22fbb0ff016219131f5ecbcd70f5ce","profile":{"lines_by_language":{"TypeScript":50276,"Shell":1475,"JavaScript":81},"files_by_category":{"source":118,"test":70,"config":33,"docs":6,"other":4,"generated":1},"source_lines":22630,"test_lines":29202},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.47,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.8248,"estimated_share":0.0,"ai_artifacts":1.0,"flagged_work_units":4.0,"flagged_releases":null,"style_index":0.133},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":74.5,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":77.6,"duplication":80.3,"lint":95.2,"testing":55.0,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.29, no CI test run detected; 8% of function code in complex or long functions; 4% duplicated lines. Weakest area: testing."},"security":{"score":59.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":99.0,"dependencies":2.4,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 108 known vulnerabilities in 30 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":42.0,"checked":42.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":28.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":52291.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2025-12":{"loc":52291,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1765925623.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1765925623}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":4.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":43129.0,"flagged_loc":43129.0,"flagged_loc_share":1.0,"max_loc_per_hour":5269.3375644585485,"median_loc_per_hour":3783.7612336255334,"pr_timed_units":0.0,"excluded_import_loc":9162.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"7,380 lines of first-party code in ~1.4h (5,269 lines/hour, 3 commit session)","ref":"7690c1a20f522262c9268ebc732c71f37c979195","url":"https://github.com/dougwithseismic/claude-does-apoc/commit/7690c1a20f522262c9268ebc732c71f37c979195","weight":0.6},{"kind":"velocity-burst","description":"5,428 lines of first-party code in ~1.3h (4,324 lines/hour, 4 commit session)","ref":"65f55ba3e42c2660c166a8523e1c10e01b760d0d","url":"https://github.com/dougwithseismic/claude-does-apoc/commit/65f55ba3e42c2660c166a8523e1c10e01b760d0d","weight":0.6},{"kind":"velocity-burst","description":"23,510 lines of first-party code in ~7.2h (3,243 lines/hour, 10 commit session)","ref":"8054dbaa25fab5e23d040e93d826c85784e19bcd","url":"https://github.com/dougwithseismic/claude-does-apoc/commit/8054dbaa25fab5e23d040e93d826c85784e19bcd","weight":0.6},{"kind":"velocity-burst","description":"6,811 lines of first-party code in ~5.9h (1,161 lines/hour, 7 commit session)","ref":"b1387ef1de22fbb0ff016219131f5ecbcd70f5ce","url":"https://github.com/dougwithseismic/claude-does-apoc/commit/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce","weight":0.3483392527347635}],"data":{"flagged_loc_by_commit":{"a68cc5ce812a4f6e7ce85b4744bcb3078c4b2529":653,"f5f1bce028ca3889e29ca690e901a9e40d283712":136,"43b4b816941e31e7d228f775d40a92f6988a77e8":2418,"3a6b53a5348f896646a3f847ac4c1c1d71374fa8":3319,"625a477977cb046dcd182ccde104e00713989ca1":2912,"6bdb1253f284115b118a9ffd1ffd7086ecf65124":2986,"4f17172232c054c2caf0154270ff6eac23cf78b7":3457,"94f302ac6567da6c3fa1300380a48313d11d8424":4217,"e69c65d96d88e63c03a809a3df0a0dc64d4c420c":3404,"8054dbaa25fab5e23d040e93d826c85784e19bcd":8,"90514d95a325646455a97a59d70f79620a5602db":3016,"1a949e7f0ddcd14bcd7f90606a2360f1b25dc943":1112,"7690c1a20f522262c9268ebc732c71f37c979195":3252,"3ecbb3d07e918fdfb82b1b995beb6e166caeeca1":2302,"b9bb46aed23615d50a26b16de9a77a8ecfc1a6ab":2584,"35a12bfae49c82877149df259115d50c7794bdcb":417,"65f55ba3e42c2660c166a8523e1c10e01b760d0d":125,"c3094f5911f32e6421a3bceeb5d76eaeebf00be8":2656,"d7105d147f4c5e19076f9ed323d242393c197e60":909,"8797b04a01910ce726f8cd0259b89b5b3352c1b9":1840,"4f911646ec268f64cbf16d7e8576e31b5c6505cd":1160,"f0010505ea84017ec48bd3c66b5ce2f1415d02e3":11,"823d565a5f5dd9d327218659d933309a30df83da":225,"b1387ef1de22fbb0ff016219131f5ecbcd70f5ce":10},"excluded_import_commits":["3287392d1b78f9434c9cf1d57fd643924287784f","664705e1c6c1a3811fd3ea8101eb9d96b3492b9f"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":22630.0,"index":0.133,"count:narrated_steps":3.0,"per_kloc:narrated_steps":0.133,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, try to find by serial","ref":"packages/core/src/device/registry.ts:172","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/core/src/device/registry.ts#L172","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Then, try to find by nickname","ref":"packages/core/src/device/registry.ts:178","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/core/src/device/registry.ts#L178","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, handle escaped variables by temporarily replacing them","ref":"packages/workflow/src/parser/interpolator.ts:77","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/workflow/src/parser/interpolator.ts#L77","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"README.md","line":394,"fingerprint":"README.md:curl-auth-header:394"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"findings_high":0.0,"findings_medium":2.0,"findings_low":2.0,"weighted_findings":0.625,"scanned_lines":22630.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"packages/workflow/src/parser/interpolator.ts","line":48,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:packages/workflow/src/parser/interpolator.ts:48"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\d+\\.\\d+\\.\\d+(?:-[a-zA-Z0-9]+(?:\\.[a-zA-Z0-9]+)*)?(?:\\+[a-zA-Z0-9]+(?:\\.[a-zA-Z0-9]+)*)?$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerab [confidence low]","path":"packages/workflow/src/parser/yaml-parser.ts","line":122,"fingerprint":"javascript.lang.security.audit.detect-redos:packages/workflow/src/parser/yaml-parser.ts:122"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"packages/server/src/streaming/scrcpy-stream-manager.ts","line":652,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:packages/server/src/streaming/scrcpy-stream-manager.ts:652"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"packages/server/src/streaming/scrcpy-stream-manager.ts","line":708,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:packages/server/src/streaming/scrcpy-stream-manager.ts:708"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":30.0,"vulnerabilities":108.0,"vulns_critical":3.0,"vulns_high":68.0,"vulns_medium":32.0,"vulns_low":5.0,"vulns_unknown":0.0,"penalty":224.0},"findings":[{"rule_id":"osv/GHSA-w7jw-789q-3m8p","severity":"critical","message":"shell-quote@1.8.3 (npm) is affected by GHSA-w7jw-789q-3m8p","path":"pnpm-lock.yaml","line":null,"fingerprint":"shell-quote@1.8.3 (npm):GHSA-w7jw-789q-3m8p"},{"rule_id":"osv/GHSA-3qcw-2rhx-2726","severity":"critical","message":"turbo@2.6.3 (npm) is affected by GHSA-3qcw-2rhx-2726","path":"pnpm-lock.yaml","line":null,"fingerprint":"turbo@2.6.3 (npm):GHSA-3qcw-2rhx-2726"},{"rule_id":"osv/GHSA-5xrq-8626-4rwp","severity":"critical","message":"vitest@4.0.16 (npm) is affected by GHSA-5xrq-8626-4rwp","path":"pnpm-lock.yaml","line":null,"fingerprint":"vitest@4.0.16 (npm):GHSA-5xrq-8626-4rwp"},{"rule_id":"osv/GHSA-27p8-2357-5qqv","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-27p8-2357-5qqv","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-27p8-2357-5qqv"},{"rule_id":"osv/GHSA-2v35-w6hq-6mfw","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-2v35-w6hq-6mfw","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-2v35-w6hq-6mfw"},{"rule_id":"osv/GHSA-4w3w-2rp5-g8jm","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-4w3w-2rp5-g8jm","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-4w3w-2rp5-g8jm"},{"rule_id":"osv/GHSA-8344-3jmq-59r6","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-8344-3jmq-59r6","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-8344-3jmq-59r6"},{"rule_id":"osv/GHSA-93r5-fhx6-vmg9","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-93r5-fhx6-vmg9","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-93r5-fhx6-vmg9"},{"rule_id":"osv/GHSA-965w-775f-mr7g","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-965w-775f-mr7g","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-965w-775f-mr7g"},{"rule_id":"osv/GHSA-c7q8-3ch8-vqpv","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-c7q8-3ch8-vqpv","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-c7q8-3ch8-vqpv"},{"rule_id":"osv/GHSA-f6ww-3ggp-fr8h","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-f6ww-3ggp-fr8h","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-f6ww-3ggp-fr8h"},{"rule_id":"osv/GHSA-j759-j44w-7fr8","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-j759-j44w-7fr8","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-j759-j44w-7fr8"},{"rule_id":"osv/GHSA-w2rr-34g9-rvrj","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-w2rr-34g9-rvrj","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-w2rr-34g9-rvrj"},{"rule_id":"osv/GHSA-wh4c-j3r5-mjhp","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-wh4c-j3r5-mjhp","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-wh4c-j3r5-mjhp"},{"rule_id":"osv/GHSA-x4fp-j954-r2f4","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-x4fp-j954-r2f4","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-x4fp-j954-r2f4"},{"rule_id":"osv/GHSA-x6wf-f3px-wcqx","severity":"high","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-x6wf-f3px-wcqx","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-x6wf-f3px-wcqx"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"pnpm-lock.yaml","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"pnpm-lock.yaml","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-247c-9743-5963","severity":"high","message":"fastify@5.6.2 (npm) is affected by GHSA-247c-9743-5963","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-247c-9743-5963"},{"rule_id":"osv/GHSA-667r-xxjv-c9mm","severity":"high","message":"fastify@5.6.2 (npm) is affected by GHSA-667r-xxjv-c9mm","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-667r-xxjv-c9mm"},{"rule_id":"osv/GHSA-9q9j-q6p8-xq58","severity":"high","message":"fastify@5.6.2 (npm) is affected by GHSA-9q9j-q6p8-xq58","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-9q9j-q6p8-xq58"},{"rule_id":"osv/GHSA-hwr6-493r-vm6h","severity":"high","message":"fastify@5.6.2 (npm) is affected by GHSA-hwr6-493r-vm6h","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-hwr6-493r-vm6h"},{"rule_id":"osv/GHSA-jx2c-rxcm-jvmq","severity":"high","message":"fastify@5.6.2 (npm) is affected by GHSA-jx2c-rxcm-jvmq","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-jx2c-rxcm-jvmq"},{"rule_id":"osv/GHSA-p68q-wchp-6fh7","severity":"high","message":"fastify@5.6.2 (npm) is affected by GHSA-p68q-wchp-6fh7","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-p68q-wchp-6fh7"},{"rule_id":"osv/GHSA-c96f-x56v-gq3h","severity":"high","message":"find-my-way@9.3.0 (npm) is affected by GHSA-c96f-x56v-gq3h","path":"pnpm-lock.yaml","line":null,"fingerprint":"find-my-way@9.3.0 (npm):GHSA-c96f-x56v-gq3h"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-25h7-pfq9-p65f","path":"pnpm-lock.yaml","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"pnpm-lock.yaml","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.3 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-6g55-p6wh-862q","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-r28c-9q8g-f849","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-mw96-cpmx-2vgc","severity":"high","message":"rollup@4.53.5 (npm) is affected by GHSA-mw96-cpmx-2vgc","path":"pnpm-lock.yaml","line":null,"fingerprint":"rollup@4.53.5 (npm):GHSA-mw96-cpmx-2vgc"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-f88m-g3jw-g9cj","path":"pnpm-lock.yaml","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-rgj7-g3m4-5g8c","path":"pnpm-lock.yaml","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"pnpm-lock.yaml","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-395f-4hp3-45gv","severity":"high","message":"shell-quote@1.8.3 (npm) is affected by GHSA-395f-4hp3-45gv","path":"pnpm-lock.yaml","line":null,"fingerprint":"shell-quote@1.8.3 (npm):GHSA-395f-4hp3-45gv"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"pnpm-lock.yaml","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@7.3.0 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-p9ff-h696-f583","severity":"high","message":"vite@7.3.0 (npm) is affected by GHSA-p9ff-h696-f583","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-p9ff-h696-f583"},{"rule_id":"osv/GHSA-v2wj-q39q-566r","severity":"high","message":"vite@7.3.0 (npm) is affected by GHSA-v2wj-q39q-566r","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-v2wj-q39q-566r"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.18.3 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"pnpm-lock.yaml","line":null,"fingerprint":"ws@8.18.3 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.2.1 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"pnpm-lock.yaml","line":null,"fingerprint":"zod@4.2.1 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.7 (npm) is affected by GHSA-p498-v437-472g","path":"pnpm-lock.yaml","line":null,"fingerprint":"@humanfs/node@0.16.7 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@4.0.16 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"pnpm-lock.yaml","line":null,"fingerprint":"@vitest/mocker@4.0.16 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.0.16 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"pnpm-lock.yaml","line":null,"fingerprint":"@vitest/mocker@4.0.16 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-6gmq-8vp8-gcm6","severity":"medium","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-6gmq-8vp8-gcm6","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-6gmq-8vp8-gcm6"},{"rule_id":"osv/GHSA-6h8r-xr42-gp59","severity":"medium","message":"@xmldom/xmldom@0.8.11 (npm) is affected by GHSA-6h8r-xr42-gp59","path":"pnpm-lock.yaml","line":null,"fingerprint":"@xmldom/xmldom@0.8.11 (npm):GHSA-6h8r-xr42-gp59"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"pnpm-lock.yaml","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@8.17.1 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"pnpm-lock.yaml","line":null,"fingerprint":"ajv@8.17.1 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.9.8 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"pnpm-lock.yaml","line":null,"fingerprint":"baseline-browser-mapping@2.9.8 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-444r-cwp2-x5xf","severity":"medium","message":"fastify@5.6.2 (npm) is affected by GHSA-444r-cwp2-x5xf","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-444r-cwp2-x5xf"},{"rule_id":"osv/GHSA-4mh8-r7rc-xpvc","severity":"medium","message":"fastify@5.6.2 (npm) is affected by GHSA-4mh8-r7rc-xpvc","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-4mh8-r7rc-xpvc"},{"rule_id":"osv/GHSA-w2qp-rph6-63g4","severity":"medium","message":"fastify@5.6.2 (npm) is affected by GHSA-w2qp-rph6-63g4","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-w2qp-rph6-63g4"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.1 (npm) is affected by GHSA-h67p-54hq-rp68","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.3 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-hcf7-66rw-9f5r","severity":"medium","message":"turbo@2.6.3 (npm) is affected by GHSA-hcf7-66rw-9f5r","path":"pnpm-lock.yaml","line":null,"fingerprint":"turbo@2.6.3 (npm):GHSA-hcf7-66rw-9f5r"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@4.0.16 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"pnpm-lock.yaml","line":null,"fingerprint":"vitest@4.0.16 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-58qx-3vcg-4xpx","severity":"medium","message":"ws@8.18.3 (npm) is affected by GHSA-58qx-3vcg-4xpx","path":"pnpm-lock.yaml","line":null,"fingerprint":"ws@8.18.3 (npm):GHSA-58qx-3vcg-4xpx"},{"rule_id":"osv/GHSA-48c2-rrv3-qjmp","severity":"medium","message":"yaml@2.8.2 (npm) is affected by GHSA-48c2-rrv3-qjmp","path":"pnpm-lock.yaml","line":null,"fingerprint":"yaml@2.8.2 (npm):GHSA-48c2-rrv3-qjmp"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.28.5 (npm) is affected by GHSA-4x5r-pxfx-6jf8","path":"pnpm-lock.yaml","line":null,"fingerprint":"@babel/core@7.28.5 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-333x-w4r6-6crp","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-mrq3-vjjr-p77c","severity":"low","message":"fastify@5.6.2 (npm) is affected by GHSA-mrq3-vjjr-p77c","path":"pnpm-lock.yaml","line":null,"fingerprint":"fastify@5.6.2 (npm):GHSA-mrq3-vjjr-p77c"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@7.3.0 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":6.0},"findings":[],"evidence":[{"kind":"posture","description":"packages/automation/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/automation/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/cli/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/cli/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/core/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/core/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/server/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/server/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/ui/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/ui/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/workflow/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/workflow/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":887.0,"function_nloc":9718.0,"mean_ccn":2.58,"p90_ccn":6.0,"complex_functions":7.0,"long_functions":4.0,"many_param_functions":0.0,"risky_nloc_share":0.0846},"findings":[],"evidence":[{"kind":"complex-function","description":"matchesSelector in packages/automation/src/ui/selector.ts: complexity 34, 70 lines","ref":"packages/automation/src/ui/selector.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/automation/src/ui/selector.ts#L84","weight":0.5666666666666667},{"kind":"complex-function","description":"TouchCanvas in packages/ui/src/components/TouchCanvas/TouchCanvas.tsx: complexity 25, 153 lines","ref":"packages/ui/src/components/TouchCanvas/TouchCanvas.tsx","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/ui/src/components/TouchCanvas/TouchCanvas.tsx#L79","weight":0.4166666666666667},{"kind":"complex-function","description":"matchesCriteria in packages/core/src/pool/manager.ts: complexity 18, 42 lines","ref":"packages/core/src/pool/manager.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/core/src/pool/manager.ts#L252","weight":0.3},{"kind":"complex-function","description":"DeviceStream in packages/ui/src/components/DeviceStream/DeviceStream.tsx: complexity 18, 115 lines","ref":"packages/ui/src/components/DeviceStream/DeviceStream.tsx","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/ui/src/components/DeviceStream/DeviceStream.tsx#L55","weight":0.3},{"kind":"complex-function","description":"parseDisplayInfo in packages/core/src/shell/screen-capture.ts: complexity 17, 45 lines","ref":"packages/core/src/shell/screen-capture.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/core/src/shell/screen-capture.ts#L133","weight":0.2833333333333333},{"kind":"complex-function","description":"validateStep in packages/workflow/src/parser/yaml-parser.ts: complexity 17, 54 lines","ref":"packages/workflow/src/parser/yaml-parser.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/workflow/src/parser/yaml-parser.ts#L179","weight":0.2833333333333333},{"kind":"complex-function","description":"parseLogcatLine in packages/core/src/shell/logcat.ts: complexity 16, 58 lines","ref":"packages/core/src/shell/logcat.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/core/src/shell/logcat.ts#L109","weight":0.26666666666666666},{"kind":"complex-function","description":"KeyboardOverlay in packages/ui/src/components/KeyboardOverlay/KeyboardOverlay.tsx: complexity 13, 130 lines","ref":"packages/ui/src/components/KeyboardOverlay/KeyboardOverlay.tsx","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/ui/src/components/KeyboardOverlay/KeyboardOverlay.tsx#L79","weight":0.21666666666666667},{"kind":"complex-function","description":"Dashboard in packages/ui/src/pages/Dashboard.tsx: complexity 10, 155 lines","ref":"packages/ui/src/pages/Dashboard.tsx","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/ui/src/pages/Dashboard.tsx#L41","weight":0.16666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":14927.0,"duplicated_lines":545.0,"duplicated_share":0.0365,"files":118.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: packages/automation/tsup.config.ts:5 and packages/cli/tsup.config.ts:5","ref":"packages/automation/tsup.config.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/automation/tsup.config.ts#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/cli/src/cli.ts:100 and packages/cli/src/cli.ts:139","ref":"packages/cli/src/cli.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/cli/src/cli.ts#L100","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/cli/src/commands/workflow.ts:129 and packages/cli/src/commands/workflow.ts:217","ref":"packages/cli/src/commands/workflow.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/cli/src/commands/workflow.ts#L129","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/cli/src/utils/device.ts:26 and packages/server/src/routes/devices.ts:38","ref":"packages/cli/src/utils/device.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/cli/src/utils/device.ts#L26","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/core/src/adb/binary.ts:45 and packages/core/src/adb/server.ts:45","ref":"packages/core/src/adb/binary.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/core/src/adb/binary.ts#L45","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/core/src/device/device.ts:89 and packages/core/src/device/device.ts:186","ref":"packages/core/src/device/device.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/core/src/device/device.ts#L89","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/server/src/routes/devices.ts:41 and packages/ui/src/utils/api.ts:17","ref":"packages/server/src/routes/devices.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/server/src/routes/devices.ts#L41","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/server/src/routes/devices.ts:72 and packages/server/src/routes/touch.ts:52","ref":"packages/server/src/routes/devices.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/server/src/routes/devices.ts#L72","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/server/src/routes/streaming.ts:151 and packages/server/src/routes/streaming.ts:232","ref":"packages/server/src/routes/streaming.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/server/src/routes/streaming.ts#L151","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/server/src/routes/streaming.ts:438 and packages/server/src/routes/touch.ts:259","ref":"packages/server/src/routes/streaming.ts","url":"https://github.com/dougwithseismic/claude-does-apoc/blob/b1387ef1de22fbb0ff016219131f5ecbcd70f5ce/packages/server/src/routes/streaming.ts#L438","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"weighted_findings":4.5,"scanned_lines":22630.0,"category:best-practice":2.0,"category:correctness":10.0},"findings":[{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/ui/src/components/DeviceList/DeviceList.tsx","line":320,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/ui/src/components/DeviceList/DeviceList.tsx:320"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/ui/src/components/DeviceList/DeviceList.tsx","line":347,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/ui/src/components/DeviceList/DeviceList.tsx:347"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/components/DeviceList/DeviceList.tsx","line":274,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/components/DeviceList/DeviceList.tsx:274"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/components/DeviceList/DeviceList.tsx","line":274,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/components/DeviceList/DeviceList.tsx:274"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/components/DeviceStream/DeviceStream.tsx","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/components/DeviceStream/DeviceStream.tsx:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/components/DeviceStream/DeviceStream.tsx","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/components/DeviceStream/DeviceStream.tsx:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/pages/Dashboard.tsx","line":317,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/pages/Dashboard.tsx:317"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/pages/Dashboard.tsx","line":317,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/pages/Dashboard.tsx:317"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/pages/Dashboard.tsx","line":352,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/pages/Dashboard.tsx:352"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/pages/Dashboard.tsx","line":352,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/pages/Dashboard.tsx:352"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/pages/Dashboard.tsx","line":520,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/pages/Dashboard.tsx:520"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ui/src/pages/Dashboard.tsx","line":520,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ui/src/pages/Dashboard.tsx:520"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":29202.0,"source_lines":22630.0,"test_ratio":1.2904,"ci_files":0.0,"cochange_share":0.84,"cochange_commits":25.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":394.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.base.json","ref":"tsconfig.base.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}