{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:04.256167Z","repo":{"ref":{"host":"github.com","owner":"engineerchuan","name":"wav2vec2.cpp"},"default_branch":"main","clone_url":"https://github.com/engineerchuan/wav2vec2.cpp.git","html_url":"https://github.com/engineerchuan/wav2vec2.cpp","description":null,"stars":2,"forks":4,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2219,"primary_language":"C++","license_spdx":"MIT","created_at":"2025-12-26T13:10:33Z","pushed_at":"2025-12-27T00:32:56Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-02-27T05:04:32Z","owner_type":"User","release_assets":[]}},"commit_sha":"db8d0f108a89fe030f4603e7d8cf6006d1978968","profile":{"lines_by_language":{"C++":144643,"C":61397,"Objective-C":2288,"Python":1172,"Shell":274},"files_by_category":{"other":512,"source":230,"docs":27,"config":6,"binary":2,"test":1},"source_lines":209536,"test_lines":238},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.7,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.176},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":50.9,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":29.4,"duplication":25.5,"lint":98.9,"testing":45.1,"docs":80.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 41% of function code in complex or long functions; 23% duplicated lines. Weakest area: duplication."},"security":{"score":68.6,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":98.1,"dependencies":null,"ci_actions":22.8,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 2 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1.0,"attributed_commits":1.0,"attributed_commit_share":1.0,"effective_loc":209774.0,"attributed_loc":209774.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 1 attributed commits, 209,774 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"db8d0f108a89fe030f4603e7d8cf6006d1978968","url":"https://github.com/engineerchuan/wav2vec2.cpp/commit/db8d0f108a89fe030f4603e7d8cf6006d1978968","weight":0.9}],"data":{"attributed_loc_by_commit":{"db8d0f108a89fe030f4603e7d8cf6006d1978968":209774},"tools":{"claude-code":{"name":"Claude Code","commits":1,"loc":209774,"first_seen":1766778086,"last_seen":1766778086}},"monthly":{"2025-12":{"loc":209774,"attributed_loc":209774}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":0.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":0.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":0.0,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":209774.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["db8d0f108a89fe030f4603e7d8cf6006d1978968"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":153845.0,"index":0.176,"count:narrated_steps":27.0,"per_kloc:narrated_steps":0.176,"files:narrated_steps":7.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, get batch results","ref":"examples/wav2vec2/wav2vec2-cli.cpp:226","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/wav2vec2/wav2vec2-cli.cpp#L226","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: * Finally, an aclTensor object is created from the cached memory and returned.","ref":"ggml/src/ggml-cann/aclnn_ops.cpp:981","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-cann/aclnn_ops.cpp#L981","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1.3: update theta_scale_tensor according to ext_factor or freq_scale.","ref":"ggml/src/ggml-cann/aclnn_ops.cpp:2385","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-cann/aclnn_ops.cpp#L2385","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1.4: prepare select index if mrope","ref":"ggml/src/ggml-cann/aclnn_ops.cpp:2404","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-cann/aclnn_ops.cpp#L2404","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 5: multiply by attn_factor","ref":"ggml/src/ggml-cann/aclnn_ops.cpp:2586","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-cann/aclnn_ops.cpp#L2586","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 6: repeat","ref":"ggml/src/ggml-cann/aclnn_ops.cpp:2603","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-cann/aclnn_ops.cpp#L2603","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Prepare trans tensors for F16 type conversion to F32 if needed","ref":"ggml/src/ggml-cann/aclnn_ops.cpp:2867","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-cann/aclnn_ops.cpp#L2867","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Prepare head tensors for tail splitting if needed","ref":"ggml/src/ggml-cann/aclnn_ops.cpp:2892","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-cann/aclnn_ops.cpp#L2892","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":41.0,"findings_high":2.0,"findings_medium":39.0,"findings_low":0.0,"weighted_findings":11.25,"scanned_lines":207248.0,"parse_errors":40.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/eval_vs_pytorch.py","line":109,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/eval_vs_pytorch.py:109"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/eval_vs_pytorch.py","line":118,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/eval_vs_pytorch.py:118"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-alloc.c","line":724,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-alloc.c:724"},{"rule_id":"opengrep/c.lang.security.function-use-after-free","severity":"medium","message":"Variable 'galloc->node_allocs' was passed to a function after being freed. This can lead to undefined behavior. [confidence low]","path":"ggml/src/ggml-alloc.c","line":857,"fingerprint":"c.lang.security.function-use-after-free:ggml/src/ggml-alloc.c:857"},{"rule_id":"opengrep/c.lang.security.function-use-after-free","severity":"medium","message":"Variable 'galloc->leaf_allocs' was passed to a function after being freed. This can lead to undefined behavior. [confidence low]","path":"ggml/src/ggml-alloc.c","line":889,"fingerprint":"c.lang.security.function-use-after-free:ggml/src/ggml-alloc.c:889"},{"rule_id":"opengrep/c.lang.security.use-after-free","severity":"medium","message":"Variable 'galloc->leaf_allocs' was used after being freed. This can lead to undefined behavior. [confidence low]","path":"ggml/src/ggml-alloc.c","line":889,"fingerprint":"c.lang.security.use-after-free:ggml/src/ggml-alloc.c:889"},{"rule_id":"opengrep/c.lang.security.function-use-after-free","severity":"medium","message":"Variable 'galloc->leaf_allocs' was passed to a function after being freed. This can lead to undefined behavior. [confidence low]","path":"ggml/src/ggml-alloc.c","line":890,"fingerprint":"c.lang.security.function-use-after-free:ggml/src/ggml-alloc.c:890"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/ggml-cpu.c","line":1590,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/ggml-cpu.c:1590"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/ggml-cpu.c","line":2626,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/ggml-cpu.c:2626"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/ggml-cpu.c","line":2733,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/ggml-cpu.c:2733"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/ggml-cpu.c","line":3132,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/ggml-cpu.c:3132"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":499,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:499"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":509,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:509"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":576,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:576"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":582,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:582"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":651,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:651"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":658,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:658"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":722,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:722"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-cpu/quants.c","line":729,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-cpu/quants.c:729"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/htp-dma.c","line":30,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/htp-dma.c:30"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/htp-dma.c","line":35,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/htp-dma.c:35"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/htp-dma.c","line":38,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/htp-dma.c:38"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/main.c","line":49,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/main.c:49"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/main.c","line":60,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/main.c:60"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/main.c","line":80,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/main.c:80"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/main.c","line":91,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/main.c:91"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/matmul-ops.c","line":1694,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/matmul-ops.c:1694"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/matmul-ops.c","line":2201,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/matmul-ops.c:2201"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/rope-ops.c","line":128,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/rope-ops.c:128"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml-hexagon/htp/softmax-ops.c","line":76,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml-hexagon/htp/softmax-ops.c:76"},{"rule_id":"opengrep/c.lang.security.insecure-use-strcat-fn","severity":"medium","message":"Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead. [confidence low]","path":"ggml/src/ggml-hexagon/htp/worker-pool.c","line":97,"fingerprint":"c.lang.security.insecure-use-strcat-fn:ggml/src/ggml-hexagon/htp/worker-pool.c:97"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":4098,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:4098"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":6108,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:6108"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":6807,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:6807"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":6808,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:6808"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":6966,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:6966"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":6967,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:6967"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":7020,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:7020"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":7021,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:7021"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":7055,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:7055"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"ggml/src/ggml.c","line":7585,"fingerprint":"c.lang.security.insecure-use-memset:ggml/src/ggml.c:7585"}],"evidence":[],"data":{"rulesets":["c","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":15.0,"findings_high":6.0,"findings_medium":9.0,"findings_low":0.0,"penalty":88.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build.yml","line":15,"fingerprint":"unpinned-uses:.github/workflows/build.yml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/build.yml:40"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build.yml","line":60,"fingerprint":"unpinned-uses:.github/workflows/build.yml:60"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/eval.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/eval.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/eval.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/eval.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/eval.yml","line":86,"fingerprint":"unpinned-uses:.github/workflows/eval.yml:86"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build.yml","line":15,"fingerprint":"artipacked:.github/workflows/build.yml:15"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build.yml","line":40,"fingerprint":"artipacked:.github/workflows/build.yml:40"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build.yml","line":60,"fingerprint":"artipacked:.github/workflows/build.yml:60"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/build.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/build.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/build.yml","line":11,"fingerprint":"excessive-permissions:.github/workflows/build.yml:11"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/build.yml","line":36,"fingerprint":"excessive-permissions:.github/workflows/build.yml:36"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/build.yml","line":56,"fingerprint":"excessive-permissions:.github/workflows/build.yml:56"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/eval.yml","line":21,"fingerprint":"artipacked:.github/workflows/eval.yml:21"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/eval.yml","line":17,"fingerprint":"excessive-permissions:.github/workflows/eval.yml:17"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":5596.0,"function_nloc":127105.0,"mean_ccn":4.53,"p90_ccn":9.0,"complex_functions":268.0,"long_functions":188.0,"many_param_functions":398.0,"risky_nloc_share":0.4078},"findings":[],"evidence":[{"kind":"complex-function","description":"ggml_backend_vk_device_supports_op in ggml/src/ggml-vulkan/ggml-vulkan.cpp: complexity 307, 453 lines","ref":"ggml/src/ggml-vulkan/ggml-vulkan.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-vulkan/ggml-vulkan.cpp#L13773","weight":1.0},{"kind":"complex-function","description":"ggml_vk_op_get_pipeline in ggml/src/ggml-vulkan/ggml-vulkan.cpp: complexity 306, 544 lines","ref":"ggml/src/ggml-vulkan/ggml-vulkan.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-vulkan/ggml-vulkan.cpp#L8294","weight":1.0},{"kind":"complex-function","description":"detail::binary_reader::parse_msgpack_internal in examples/json.hpp: complexity 273, 340 lines","ref":"examples/json.hpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/json.hpp#L10270","weight":1.0},{"kind":"complex-function","description":"detail::binary_reader::parse_cbor_internal in examples/json.hpp: complexity 239, 425 lines","ref":"examples/json.hpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/json.hpp#L9494","weight":1.0},{"kind":"complex-function","description":"detail::lexer::scan_string in examples/json.hpp: complexity 212, 488 lines","ref":"examples/json.hpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/json.hpp#L7555","weight":1.0},{"kind":"complex-function","description":"ggml_backend_sycl_device_supports_op in ggml/src/ggml-sycl/ggml-sycl.cpp: complexity 203, 278 lines","ref":"ggml/src/ggml-sycl/ggml-sycl.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-sycl/ggml-sycl.cpp#L4358","weight":1.0},{"kind":"complex-function","description":"ggml_vk_get_device in ggml/src/ggml-vulkan/ggml-vulkan.cpp: complexity 181, 547 lines","ref":"ggml/src/ggml-vulkan/ggml-vulkan.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-vulkan/ggml-vulkan.cpp#L4241","weight":1.0},{"kind":"complex-function","description":"ggml_cl_mul_mat in ggml/src/ggml-opencl/ggml-opencl.cpp: complexity 176, 788 lines","ref":"ggml/src/ggml-opencl/ggml-opencl.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-opencl/ggml-opencl.cpp#L7143","weight":1.0},{"kind":"complex-function","description":"ggml_metal_device_supports_op in ggml/src/ggml-metal/ggml-metal-device.m: complexity 167, 242 lines","ref":"ggml/src/ggml-metal/ggml-metal-device.m","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-metal/ggml-metal-device.m#L929","weight":1.0},{"kind":"complex-function","description":"ggml_vk_load_shaders in ggml/src/ggml-vulkan/ggml-vulkan.cpp: complexity 167, 1073 lines","ref":"ggml/src/ggml-vulkan/ggml-vulkan.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/src/ggml-vulkan/ggml-vulkan.cpp#L2726","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":150528.0,"duplicated_lines":34321.0,"duplicated_share":0.228,"files":230.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: examples/common-ggml.cpp:181 and ggml/src/ggml-sycl/ggml-sycl.cpp:3048","ref":"examples/common-ggml.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/common-ggml.cpp#L181","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/common-ggml.cpp:203 and ggml/src/ggml-webgpu/ggml-webgpu.cpp:2380","ref":"examples/common-ggml.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/common-ggml.cpp#L203","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/common.cpp:401 and examples/common.h:113","ref":"examples/common.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/common.cpp#L401","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/common.cpp:420 and examples/common.cpp:535","ref":"examples/common.cpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/common.cpp#L420","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/json.hpp:1 and examples/json.hpp:36","ref":"examples/json.hpp","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/examples/json.hpp#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: ggml/include/ggml-cann.h:2 and ggml/src/ggml-cann/acl_tensor.cpp:2","ref":"ggml/include/ggml-cann.h","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/include/ggml-cann.h#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: ggml/include/ggml-cann.h:63 and ggml/src/ggml-cann/ggml-cann.cpp:1497","ref":"ggml/include/ggml-cann.h","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/include/ggml-cann.h#L63","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: ggml/include/ggml-opt.h:230 and ggml/src/ggml-opt.cpp:926","ref":"ggml/include/ggml-opt.h","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/include/ggml-opt.h#L230","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: ggml/include/ggml.h:907 and ggml/include/ggml.h:916","ref":"ggml/include/ggml.h","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/include/ggml.h#L907","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: ggml/include/ggml.h:1879 and ggml/src/ggml.c:4291","ref":"ggml/include/ggml.h","url":"https://github.com/engineerchuan/wav2vec2.cpp/blob/db8d0f108a89fe030f4603e7d8cf6006d1978968/ggml/include/ggml.h#L1879","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"weighted_findings":9.25,"scanned_lines":207248.0,"category:best-practice":8.0,"category:correctness":5.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ggml/src/ggml-cuda/template-instances/generate_cu_files.py","line":65,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ggml/src/ggml-cuda/template-instances/generate_cu_files.py:65"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ggml/src/ggml-cuda/template-instances/generate_cu_files.py","line":70,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ggml/src/ggml-cuda/template-instances/generate_cu_files.py:70"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ggml/src/ggml-cuda/template-instances/generate_cu_files.py","line":78,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ggml/src/ggml-cuda/template-instances/generate_cu_files.py:78"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ggml/src/ggml-cuda/template-instances/generate_cu_files.py","line":94,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ggml/src/ggml-cuda/template-instances/generate_cu_files.py:94"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ggml/src/ggml-cuda/template-instances/generate_cu_files.py","line":98,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ggml/src/ggml-cuda/template-instances/generate_cu_files.py:98"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ggml/src/ggml-opencl/kernels/embed_kernel.py","line":15,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ggml/src/ggml-opencl/kernels/embed_kernel.py:15"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ggml/src/ggml-opencl/kernels/embed_kernel.py","line":16,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ggml/src/ggml-opencl/kernels/embed_kernel.py:16"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/eval_vs_pytorch.py","line":374,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/eval_vs_pytorch.py:374"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"build-wav2vec2-xcframework.sh","line":49,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:build-wav2vec2-xcframework.sh:49"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"build-wav2vec2-xcframework.sh","line":63,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:build-wav2vec2-xcframework.sh:63"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"build-wav2vec2-xcframework.sh","line":125,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:build-wav2vec2-xcframework.sh:125"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"build-wav2vec2-xcframework.sh","line":127,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:build-wav2vec2-xcframework.sh:127"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"build-wav2vec2-xcframework.sh","line":127,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:build-wav2vec2-xcframework.sh:127"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0023,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":238.0,"source_lines":209536.0,"test_ratio":0.0011,"ci_files":2.0,"cochange_share":1.0,"cochange_commits":1.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build.yml","ref":".github/workflows/build.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/eval.yml","ref":".github/workflows/eval.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":115.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":209536.0,"other_lines":0.0,"files_blamed":230.0,"blame_failures":0.0,"quality:ai_findings":13.0,"quality:ai_per_kloc":0.062,"quality:other_findings":0.0,"security:ai_findings":41.0,"security:ai_per_kloc":0.196,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}