{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:56:59.915918Z","repo":{"ref":{"host":"github.com","owner":"ellie","name":"lgtm"},"default_branch":"main","clone_url":"https://github.com/ellie/lgtm.git","html_url":"https://github.com/ellie/lgtm","description":null,"stars":105,"forks":12,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":721,"primary_language":"Rust","license_spdx":"MIT","created_at":"2026-07-10T19:29:42Z","pushed_at":"2026-08-04T21:12:28Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-07-25T19:09:19Z","owner_type":"User","release_assets":[{"name":"LGTM.dmg","size":18110211,"download_count":18,"release_tag":"latest","url":"https://github.com/ellie/lgtm/releases/download/latest/LGTM.dmg"}]}},"commit_sha":"b929ee6033f92b6af4ac38c0e033281ef540ceab","profile":{"lines_by_language":{"Rust":14833},"files_by_category":{"config":9,"source":8,"docs":2,"binary":2,"generated":1},"source_lines":14833,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.47,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.5778,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":2.0,"flagged_releases":null},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":53.0,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":44.8,"duplication":72.2,"lint":100.0,"testing":15.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 27% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing."},"security":{"score":62.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":96.0,"dependencies":10.2,"ci_actions":65.7,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 53 known vulnerabilities in 35 dependencies; 2 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":32.0,"checked":32.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":29.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":16183.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-07":{"loc":15969,"attributed_loc":0},"2026-08":{"loc":214,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":14.0,"flagged_units":2.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":16183.0,"flagged_loc":9350.0,"flagged_loc_share":0.5777667923129209,"max_loc_per_hour":2489.389855427591,"median_loc_per_hour":79.11442433433257,"pr_timed_units":9.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,822 lines of first-party code in ~1.1h (2,489 lines/hour, 2 commit session)","ref":"3a7e19ca5004fa1630762c88f0ffa24bd637dc44","url":"https://github.com/ellie/lgtm/commit/3a7e19ca5004fa1630762c88f0ffa24bd637dc44","weight":0.6},{"kind":"velocity-burst","description":"6,528 lines of first-party code in ~3.7h (1,776 lines/hour, 11 commit session)","ref":"8594e56fedcdfc8fda23e53a5e3889be5a5213fc","url":"https://github.com/ellie/lgtm/commit/8594e56fedcdfc8fda23e53a5e3889be5a5213fc","weight":0.5326966377030601}],"data":{"flagged_loc_by_commit":{"64ce7e24f0d2f0ed1190e2a35f25221a572222a7":220,"33f2fe758de3da17d4297d3febaf74fb07f4816f":527,"3a97da05386ebf5693022077c400f1f171ebff2d":14,"4c0e18a877e3e7b0ec47a50cde7d1342f57ee0da":7,"1dee522ee2d7377cbf60b3cfb3fc4e365dd4911b":841,"87aa23934d2becf72b71337dc15ae72e64294a67":1215,"d4dca2f3155c2ab2a95fb7c87941e2ac4e97c298":761,"11a41170dda31787a3a4c485a9840a6143a2443b":501,"3e2d8555e24957a93252f3d0249b5ffc311d0c66":1139,"3ff0c5f754e393f605b4eb5fac039eb634ec3152":606,"8594e56fedcdfc8fda23e53a5e3889be5a5213fc":697,"b7fc04e28f2823713fd6b2a1b079a0d411dac188":1507,"3a7e19ca5004fa1630762c88f0ffa24bd637dc44":1315},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":4252.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":7.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":7.0,"weighted_findings":1.75,"scanned_lines":14833.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"crates/app/src/lsp_client.rs","line":560,"fingerprint":"rust.lang.security.unsafe-usage:crates/app/src/lsp_client.rs:560"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"crates/app/src/lsp_client.rs","line":772,"fingerprint":"rust.lang.security.current-exe:crates/app/src/lsp_client.rs:772"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"crates/app/src/lsp_client.rs","line":972,"fingerprint":"rust.lang.security.temp-dir:crates/app/src/lsp_client.rs:972"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"crates/app/src/lsp_client.rs","line":1146,"fingerprint":"rust.lang.security.temp-dir:crates/app/src/lsp_client.rs:1146"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"crates/app/src/main.rs","line":157,"fingerprint":"rust.lang.security.args:crates/app/src/main.rs:157"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"crates/app/src/main.rs","line":3744,"fingerprint":"rust.lang.security.temp-dir:crates/app/src/main.rs:3744"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"crates/app/src/main.rs","line":10535,"fingerprint":"rust.lang.security.temp-dir:crates/app/src/main.rs:10535"}],"evidence":[],"data":{"rulesets":["rust"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":35.0,"vulnerabilities":53.0,"vulns_critical":2.0,"vulns_high":10.0,"vulns_medium":5.0,"vulns_low":2.0,"vulns_unknown":34.0,"penalty":137.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0369","severity":"critical","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0369","path":"Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):RUSTSEC-2026-0369"},{"rule_id":"osv/GHSA-m665-v7pm-7grj","severity":"critical","message":"zip@2.4.2 (crates.io) is affected by GHSA-m665-v7pm-7grj","path":"Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):GHSA-m665-v7pm-7grj"},{"rule_id":"osv/RUSTSEC-2026-0194","severity":"high","message":"quick-xml@0.30.0 (crates.io) is affected by RUSTSEC-2026-0194","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.30.0 (crates.io):RUSTSEC-2026-0194"},{"rule_id":"osv/RUSTSEC-2026-0195","severity":"high","message":"quick-xml@0.30.0 (crates.io) is affected by RUSTSEC-2026-0195","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.30.0 (crates.io):RUSTSEC-2026-0195"},{"rule_id":"osv/RUSTSEC-2026-0194","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0194","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0194"},{"rule_id":"osv/RUSTSEC-2026-0195","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0195","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0195"},{"rule_id":"osv/RUSTSEC-2026-0194","severity":"high","message":"quick-xml@0.40.1 (crates.io) is affected by RUSTSEC-2026-0194","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.40.1 (crates.io):RUSTSEC-2026-0194"},{"rule_id":"osv/RUSTSEC-2026-0195","severity":"high","message":"quick-xml@0.40.1 (crates.io) is affected by RUSTSEC-2026-0195","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.40.1 (crates.io):RUSTSEC-2026-0195"},{"rule_id":"osv/RUSTSEC-2026-0340","severity":"high","message":"quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0340","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.16 (crates.io):RUSTSEC-2026-0340"},{"rule_id":"osv/RUSTSEC-2026-0341","severity":"high","message":"quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0341","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.16 (crates.io):RUSTSEC-2026-0341"},{"rule_id":"osv/RUSTSEC-2026-0367","severity":"high","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0367","path":"Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):RUSTSEC-2026-0367"},{"rule_id":"osv/GHSA-q7v9-x93c-xqv3","severity":"high","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3","path":"Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):GHSA-q7v9-x93c-xqv3"},{"rule_id":"osv/RUSTSEC-2025-0052","severity":"medium","message":"async-std@1.13.2 (crates.io) is affected by RUSTSEC-2025-0052","path":"Cargo.lock","line":null,"fingerprint":"async-std@1.13.2 (crates.io):RUSTSEC-2025-0052"},{"rule_id":"osv/RUSTSEC-2025-0141","severity":"medium","message":"bincode@1.3.3 (crates.io) is affected by RUSTSEC-2025-0141","path":"Cargo.lock","line":null,"fingerprint":"bincode@1.3.3 (crates.io):RUSTSEC-2025-0141"},{"rule_id":"osv/RUSTSEC-2026-0221","severity":"medium","message":"event-listener@5.4.1 (crates.io) is affected by RUSTSEC-2026-0221","path":"Cargo.lock","line":null,"fingerprint":"event-listener@5.4.1 (crates.io):RUSTSEC-2026-0221"},{"rule_id":"osv/RUSTSEC-2026-0183","severity":"medium","message":"git2@0.20.4 (crates.io) is affected by RUSTSEC-2026-0183","path":"Cargo.lock","line":null,"fingerprint":"git2@0.20.4 (crates.io):RUSTSEC-2026-0183"},{"rule_id":"osv/RUSTSEC-2026-0184","severity":"medium","message":"git2@0.20.4 (crates.io) is affected by RUSTSEC-2026-0184","path":"Cargo.lock","line":null,"fingerprint":"git2@0.20.4 (crates.io):RUSTSEC-2026-0184"},{"rule_id":"osv/GHSA-38c5-483c-4qqp","severity":"medium","message":"grid@0.18.0 (crates.io) is affected by GHSA-38c5-483c-4qqp","path":"Cargo.lock","line":null,"fingerprint":"grid@0.18.0 (crates.io):GHSA-38c5-483c-4qqp"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.4.15 (crates.io) is affected by RUSTSEC-2026-0258","path":"Cargo.lock","line":null,"fingerprint":"h2@0.4.15 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2024-0384","severity":"medium","message":"instant@0.1.13 (crates.io) is affected by RUSTSEC-2024-0384","path":"Cargo.lock","line":null,"fingerprint":"instant@0.1.13 (crates.io):RUSTSEC-2024-0384"},{"rule_id":"osv/RUSTSEC-2022-0081","severity":"medium","message":"json@0.12.4 (crates.io) is affected by RUSTSEC-2022-0081","path":"Cargo.lock","line":null,"fingerprint":"json@0.12.4 (crates.io):RUSTSEC-2022-0081"},{"rule_id":"osv/RUSTSEC-2026-0459","severity":"medium","message":"libsqlite3-sys@0.30.1 (crates.io) is affected by RUSTSEC-2026-0459","path":"Cargo.lock","line":null,"fingerprint":"libsqlite3-sys@0.30.1 (crates.io):RUSTSEC-2026-0459"},{"rule_id":"osv/RUSTSEC-2026-0418","severity":"medium","message":"libz-sys@1.1.29 (crates.io) is affected by RUSTSEC-2026-0418","path":"Cargo.lock","line":null,"fingerprint":"libz-sys@1.1.29 (crates.io):RUSTSEC-2026-0418"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0441","severity":"medium","message":"pin-utils@0.1.0 (crates.io) is affected by RUSTSEC-2026-0441","path":"Cargo.lock","line":null,"fingerprint":"pin-utils@0.1.0 (crates.io):RUSTSEC-2026-0441"},{"rule_id":"osv/RUSTSEC-2024-0370","severity":"medium","message":"proc-macro-error@0.4.12 (crates.io) is affected by RUSTSEC-2024-0370","path":"Cargo.lock","line":null,"fingerprint":"proc-macro-error@0.4.12 (crates.io):RUSTSEC-2024-0370"},{"rule_id":"osv/RUSTSEC-2026-0173","severity":"medium","message":"proc-macro-error2@2.0.1 (crates.io) is affected by RUSTSEC-2026-0173","path":"Cargo.lock","line":null,"fingerprint":"proc-macro-error2@2.0.1 (crates.io):RUSTSEC-2026-0173"},{"rule_id":"osv/RUSTSEC-2026-0338","severity":"medium","message":"quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0338","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.16 (crates.io):RUSTSEC-2026-0338"},{"rule_id":"osv/RUSTSEC-2026-0339","severity":"medium","message":"quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0339","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.16 (crates.io):RUSTSEC-2026-0339"},{"rule_id":"osv/RUSTSEC-2026-0342","severity":"medium","message":"quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0342","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.16 (crates.io):RUSTSEC-2026-0342"},{"rule_id":"osv/RUSTSEC-2026-0523","severity":"medium","message":"quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0523","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.16 (crates.io):RUSTSEC-2026-0523"},{"rule_id":"osv/RUSTSEC-2026-0524","severity":"medium","message":"quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0524","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.16 (crates.io):RUSTSEC-2026-0524"},{"rule_id":"osv/RUSTSEC-2026-0538","severity":"medium","message":"quinn-udp@0.5.15 (crates.io) is affected by RUSTSEC-2026-0538","path":"Cargo.lock","line":null,"fingerprint":"quinn-udp@0.5.15 (crates.io):RUSTSEC-2026-0538"},{"rule_id":"osv/RUSTSEC-2026-0235","severity":"medium","message":"rkyv@0.7.46 (crates.io) is affected by RUSTSEC-2026-0235","path":"Cargo.lock","line":null,"fingerprint":"rkyv@0.7.46 (crates.io):RUSTSEC-2026-0235"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2025-0134","severity":"medium","message":"rustls-pemfile@2.2.0 (crates.io) is affected by RUSTSEC-2025-0134","path":"Cargo.lock","line":null,"fingerprint":"rustls-pemfile@2.2.0 (crates.io):RUSTSEC-2025-0134"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.13 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.13 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0206","severity":"medium","message":"rustybuzz@0.14.1 (crates.io) is affected by RUSTSEC-2026-0206","path":"Cargo.lock","line":null,"fingerprint":"rustybuzz@0.14.1 (crates.io):RUSTSEC-2026-0206"},{"rule_id":"osv/RUSTSEC-2026-0206","severity":"medium","message":"rustybuzz@0.20.1 (crates.io) is affected by RUSTSEC-2026-0206","path":"Cargo.lock","line":null,"fingerprint":"rustybuzz@0.20.1 (crates.io):RUSTSEC-2026-0206"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.52.3 (crates.io) is affected by RUSTSEC-2026-0386","path":"Cargo.lock","line":null,"fingerprint":"tokio@1.52.3 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0192","severity":"medium","message":"ttf-parser@0.20.0 (crates.io) is affected by RUSTSEC-2026-0192","path":"Cargo.lock","line":null,"fingerprint":"ttf-parser@0.20.0 (crates.io):RUSTSEC-2026-0192"},{"rule_id":"osv/RUSTSEC-2026-0192","severity":"medium","message":"ttf-parser@0.21.1 (crates.io) is affected by RUSTSEC-2026-0192","path":"Cargo.lock","line":null,"fingerprint":"ttf-parser@0.21.1 (crates.io):RUSTSEC-2026-0192"},{"rule_id":"osv/RUSTSEC-2026-0192","severity":"medium","message":"ttf-parser@0.25.1 (crates.io) is affected by RUSTSEC-2026-0192","path":"Cargo.lock","line":null,"fingerprint":"ttf-parser@0.25.1 (crates.io):RUSTSEC-2026-0192"},{"rule_id":"osv/RUSTSEC-2024-0449","severity":"medium","message":"unsafe-libyaml@0.2.11 (crates.io) is affected by RUSTSEC-2024-0449","path":"Cargo.lock","line":null,"fingerprint":"unsafe-libyaml@0.2.11 (crates.io):RUSTSEC-2024-0449"},{"rule_id":"osv/RUSTSEC-2026-0371","severity":"medium","message":"zbus_names@4.3.3 (crates.io) is affected by RUSTSEC-2026-0371","path":"Cargo.lock","line":null,"fingerprint":"zbus_names@4.3.3 (crates.io):RUSTSEC-2026-0371"},{"rule_id":"osv/RUSTSEC-2026-0368","severity":"medium","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0368","path":"Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):RUSTSEC-2026-0368"},{"rule_id":"osv/GHSA-8hxf-qr8p-62x4","severity":"medium","message":"zip@2.4.2 (crates.io) is affected by GHSA-8hxf-qr8p-62x4","path":"Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):GHSA-8hxf-qr8p-62x4"},{"rule_id":"osv/RUSTSEC-2026-0370","severity":"medium","message":"zvariant@5.13.0 (crates.io) is affected by RUSTSEC-2026-0370","path":"Cargo.lock","line":null,"fingerprint":"zvariant@5.13.0 (crates.io):RUSTSEC-2026-0370"},{"rule_id":"osv/RUSTSEC-2026-0372","severity":"medium","message":"zvariant_derive@5.13.0 (crates.io) is affected by RUSTSEC-2026-0372","path":"Cargo.lock","line":null,"fingerprint":"zvariant_derive@5.13.0 (crates.io):RUSTSEC-2026-0372"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-w44r-93j7-qv28"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":3.0,"findings_high":2.0,"findings_medium":1.0,"findings_low":0.0,"penalty":25.2},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/release.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/release.yml:23"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":21,"fingerprint":"artipacked:.github/workflows/release.yml:21"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.3793,"unpinned_manifests":6.0},"findings":[],"evidence":[{"kind":"posture","description":"crates/app/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/app/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/claude/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/claude/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/diff-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/diff-core/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/gh/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/gh/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/git/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/git/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/syntax/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/syntax/Cargo.toml","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":2.0,"binary_assets":1.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release latest ships LGTM.dmg (18 downloads)","ref":"LGTM.dmg","url":"https://github.com/ellie/lgtm/releases/download/latest/LGTM.dmg","weight":0.0},{"kind":"readme-download-lure","description":"links directly to a downloadable archive or installer","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["binary-release-assets","readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":446.0,"function_nloc":11560.0,"mean_ccn":4.04,"p90_ccn":9.0,"complex_functions":16.0,"long_functions":15.0,"many_param_functions":5.0,"risky_nloc_share":0.2675},"findings":[],"evidence":[{"kind":"complex-function","description":"render in crates/app/src/main.rs: complexity 41, 333 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L8112","weight":0.6833333333333333},{"kind":"complex-function","description":"parse_patch in crates/diff-core/src/lib.rs: complexity 29, 103 lines","ref":"crates/diff-core/src/lib.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/diff-core/src/lib.rs#L74","weight":0.48333333333333334},{"kind":"complex-function","description":"send_chat in crates/app/src/main.rs: complexity 27, 160 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L6318","weight":0.45},{"kind":"complex-function","description":"build_rows in crates/app/src/main.rs: complexity 27, 290 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L999","weight":0.45},{"kind":"complex-function","description":"render_row in crates/app/src/main.rs: complexity 26, 321 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L1496","weight":0.43333333333333335},{"kind":"complex-function","description":"render_palette in crates/app/src/main.rs: complexity 25, 278 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L7563","weight":0.4166666666666667},{"kind":"complex-function","description":"minimap_runs in crates/app/src/main.rs: complexity 25, 87 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L1991","weight":0.4166666666666667},{"kind":"complex-function","description":"render_sidebar in crates/app/src/main.rs: complexity 23, 297 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L7247","weight":0.38333333333333336},{"kind":"complex-function","description":"language_for_path in crates/syntax/src/lib.rs: complexity 21, 27 lines","ref":"crates/syntax/src/lib.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/syntax/src/lib.rs#L340","weight":0.35},{"kind":"complex-function","description":"merge_highlights in crates/app/src/main.rs: complexity 20, 53 lines","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L1330","weight":0.3333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":11558.0,"duplicated_lines":629.0,"duplicated_share":0.0544,"files":8.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: crates/app/src/lsp_client.rs:125 and crates/app/src/lsp_client.rs:655","ref":"crates/app/src/lsp_client.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/lsp_client.rs#L125","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: crates/app/src/main.rs:440 and crates/app/src/main.rs:3612","ref":"crates/app/src/main.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/app/src/main.rs#L440","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: crates/diff-core/src/lib.rs:241 and crates/diff-core/src/lib.rs:267","ref":"crates/diff-core/src/lib.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/diff-core/src/lib.rs#L241","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: crates/git/src/lib.rs:35 and crates/git/src/lib.rs:101","ref":"crates/git/src/lib.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/git/src/lib.rs#L35","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: crates/syntax/src/lib.rs:170 and crates/syntax/src/lib.rs:192","ref":"crates/syntax/src/lib.rs","url":"https://github.com/ellie/lgtm/blob/b929ee6033f92b6af4ac38c0e033281ef540ceab/crates/syntax/src/lib.rs#L170","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":14833.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":14833.0,"test_ratio":0.0,"ci_files":1.0,"cochange_share":0.0,"cochange_commits":25.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":52.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}