{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:53:32.638177Z","repo":{"ref":{"host":"github.com","owner":"ezyang","name":"scubaduck"},"default_branch":"main","clone_url":"https://github.com/ezyang/scubaduck.git","html_url":"https://github.com/ezyang/scubaduck","description":null,"stars":62,"forks":6,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":461,"primary_language":"Python","license_spdx":null,"created_at":"2025-05-18T12:32:03Z","pushed_at":"2025-05-23T03:27:08Z","security_policy_url":null,"distribution":{"owner_created_at":"2008-06-13T04:11:18Z","owner_type":"User","release_assets":[]}},"commit_sha":"00a2a565b7ebe537c883bffab7698b956f1738a2","profile":{"lines_by_language":{"Python":3660,"JavaScript":1884,"Shell":5},"files_by_category":{"test":16,"source":10,"config":4,"docs":2,"other":2,"generated":1},"source_lines":2673,"test_lines":2876},"pillars":{"ai_provenance":{"score":98.1,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.9807,"suspected_share":0.0,"estimated_share":0.9807,"ai_artifacts":1.0,"flagged_work_units":1.0,"flagged_releases":null},"summary":"Explicit AI attribution on 98% of first-party code added; an estimated 98% including velocity signals."},"quality":{"score":59.5,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":31.1,"duplication":89.3,"lint":12.8,"testing":100.0,"docs":40.0,"type_safety":60.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 1.08, CI runs tests; 39% of function code in complex or long functions; 2% duplicated lines. Weakest area: lint."},"security":{"score":49.7,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":5.8,"dependencies":53.1,"ci_actions":39.9,"posture":20.0,"scorecard":null},"summary":"Security posture is poor: 18 known vulnerabilities in 7 dependencies; 20 high-severity SAST findings; 4 high-severity workflow issues. Weakest area: sast."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":3.0,"checked":3.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":159.0,"attributed_commits":139.0,"attributed_commit_share":0.8742138364779874,"effective_loc":7601.0,"attributed_loc":7454.0,"attributed_loc_share":0.9806604394158663,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"OpenAI Codex: 139 attributed commits, 7,454 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/add-test-for-scubaduck_db-with-parquet-file'","ref":"9a90e2504b881923732f6899e9a50b07899ae219","url":"https://github.com/ezyang/scubaduck/commit/9a90e2504b881923732f6899e9a50b07899ae219","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix--unknown-column--samples--error'","ref":"4a407fe09e1f1d24bb85f95b945d36a686ac2b57","url":"https://github.com/ezyang/scubaduck/commit/4a407fe09e1f1d24bb85f95b945d36a686ac2b57","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/run-and-fix-tests'","ref":"e08b86baa34cfb3a5182ad3681596db58c2b1642","url":"https://github.com/ezyang/scubaduck/commit/e08b86baa34cfb3a5182ad3681596db58c2b1642","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/filter-series-beyond-limit-on-server-side'","ref":"2451f864f3fec8ad4422f119f55359deeef24f66","url":"https://github.com/ezyang/scubaduck/commit/2451f864f3fec8ad4422f119f55359deeef24f66","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/suggest-correct-time-unit-for-errors'","ref":"b2bd0b9c4ad50e37b08bc506d29b98c1edb7d3a6","url":"https://github.com/ezyang/scubaduck/commit/b2bd0b9c4ad50e37b08bc506d29b98c1edb7d3a6","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/add-test-for-45deg-x-axis-labels-truncation'","ref":"6afebd641798d002d60f4bc883c166b1e0e9ac39","url":"https://github.com/ezyang/scubaduck/commit/6afebd641798d002d60f4bc883c166b1e0e9ac39","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/scroll-dropdown-to-current-selection'","ref":"079223c1ff5209fba979fad03f8178f7e3c03886","url":"https://github.com/ezyang/scubaduck/commit/079223c1ff5209fba979fad03f8178f7e3c03886","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-time-series-aggregation-bug'","ref":"80a8cedc3fc2d49185d00e1c7ed03f2cbb8cc8ab","url":"https://github.com/ezyang/scubaduck/commit/80a8cedc3fc2d49185d00e1c7ed03f2cbb8cc8ab","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/add-test-for-bytes-serialization-to-json'","ref":"e90ea2e7d9288691773ea777ed5f4dffe4b5f6f3","url":"https://github.com/ezyang/scubaduck/commit/e90ea2e7d9288691773ea777ed5f4dffe4b5f6f3","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-table-view-alignment-issue'","ref":"a8074f6ccca3f3c7a48bdc2aa762ea90177b1b87","url":"https://github.com/ezyang/scubaduck/commit/a8074f6ccca3f3c7a48bdc2aa762ea90177b1b87","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/reset-view-settings-on-table-switch'","ref":"2ac2fc5088f297ae0f0b00b319b420d450c710a7","url":"https://github.com/ezyang/scubaduck/commit/2ac2fc5088f297ae0f0b00b319b420d450c710a7","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/add--samples--order-by-option'","ref":"9b4de028df02ef944bae7bff88c2845de91abf0d","url":"https://github.com/ezyang/scubaduck/commit/9b4de028df02ef944bae7bff88c2845de91abf0d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/update-table-view-to-hide-unnecessary-columns-for-count-aggr'","ref":"e97f6a8ce9dae10e4c010f5263b5a83234894ac1","url":"https://github.com/ezyang/scubaduck/commit/e97f6a8ce9dae10e4c010f5263b5a83234894ac1","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/refactor-tests-to-set-default-order-by'","ref":"0842e8310c2f32530cff723a0e9cfd2330394697","url":"https://github.com/ezyang/scubaduck/commit/0842e8310c2f32530cff723a0e9cfd2330394697","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-avg-aggregate-for-boolean-column'","ref":"ec2e26312d1464f02b3ac79d9c96d56920c8367e","url":"https://github.com/ezyang/scubaduck/commit/ec2e26312d1464f02b3ac79d9c96d56920c8367e","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/support-relative-month/year-suffixes'","ref":"ff4602301c7a4066debb4660b2cf0493f9ddae78","url":"https://github.com/ezyang/scubaduck/commit/ff4602301c7a4066debb4660b2cf0493f9ddae78","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-time-column-start/end-bugs'","ref":"078e99e92523f560b7a41f0d32319a8679c12a4b","url":"https://github.com/ezyang/scubaduck/commit/078e99e92523f560b7a41f0d32319a8679c12a4b","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/left-align-table-headers'","ref":"1fe93229873ac2ce2963d0c1834af5d499a224ae","url":"https://github.com/ezyang/scubaduck/commit/1fe93229873ac2ce2963d0c1834af5d499a224ae","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/ignore-unselected-columns-in-order-by'","ref":"656055b5a359835d50457447b9db5d84d9ddc3ad","url":"https://github.com/ezyang/scubaduck/commit/656055b5a359835d50457447b9db5d84d9ddc3ad","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/implicitly-select-column-in-order-by'","ref":"352a2427fe63bb8e5562b33f919cd5db9d084c08","url":"https://github.com/ezyang/scubaduck/commit/352a2427fe63bb8e5562b33f919cd5db9d084c08","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/hide-unit-selector-when-time-is-none'","ref":"f8ed2883526bddef80145991b0f4003b40fed80a","url":"https://github.com/ezyang/scubaduck/commit/f8ed2883526bddef80145991b0f4003b40fed80a","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/refactor-and-split-test_web.py'","ref":"68f7fcdac176a0cb0b8a2c8721afdc18e66fc027","url":"https://github.com/ezyang/scubaduck/commit/68f7fcdac176a0cb0b8a2c8721afdc18e66fc027","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/factor-out-view-settings-logic-to-js-file'","ref":"e77c4657c7a524b4c6bf7a6afe5a14e1de44b190","url":"https://github.com/ezyang/scubaduck/commit/e77c4657c7a524b4c6bf7a6afe5a14e1de44b190","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/update-guesstimecolumn-function-logic'","ref":"6b93e209ea806e5c07615c554ba349a83c9307c5","url":"https://github.com/ezyang/scubaduck/commit/6b93e209ea806e5c07615c554ba349a83c9307c5","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/split-test_server.py-into-multiple-files'","ref":"ee84b23632a030f62f2bc7c7db8c6b053f692b3f","url":"https://github.com/ezyang/scubaduck/commit/ee84b23632a030f62f2bc7c7db8c6b053f692b3f","weight":0.9}],"data":{"attributed_loc_by_commit":{"92fdccac665494fb03c05339a909b36a3b8e73fe":142,"0bd5ab10ab1b49965b5cfd229442c1a9856661e7":91,"62dbad25fad5b41aa050ce4a91ab9d9273394b94":31,"1493c44626ead8001e365045f76f224985e51283":0,"b235d28aa309f7e4d894b8e978cf3aa176f2ac8a":1,"5b74d12c7a7d5d3993ecb31b511a169c0cebb0e9":1,"818e9a5c0da942b5c75164bc6b355f3f791a0f32":18,"f63eb4870bd56559faddd6b7aa21cd4dbd5bffb0":38,"2c1285e6f45e8627a0b4a4ce245989cf35646f21":40,"685a5ffe869f66c458200b87ebd1890364c1c5a2":0,"9330429c07ce09485b30b353a38038e2bd4c56f9":4,"6a6ce00c892739c425bb1670ed5947ca85a2afff":0,"0bbb3f58a144069d978d56c7ab1d0a4c966caea7":0,"642f7fedd38688281bab443b518d02c9e4cbf30b":5,"b83a0b69de9ab08d51f2969fc594bf4974c5b7d7":0,"8f0724af59e92b799df495f199d2f3a218dbc441":53,"be7bd4065ca020367ba32ac932512a4d20aca12f":10,"1b4e13c0e09c342d3157ce49efff2fea9831c000":3,"c1dd68f3dfd9af0342689b2833dd8c0878283d03":0,"28b6ee044d8ea2a877b3fb4d2f2d969d79711168":119,"77b728b9724d3232df7774548db5408051de7282":2,"a820259553ff1943f9b55f5513e1b0a08673845a":13,"7050d9fc43965cf4b370086e1892f83902672fe2":14,"16f79a256f1bf0bca7e0538f325269f6b010fd31":72,"c72c215bf9d9188a655c89c1478d7c762300b698":45,"47b211b6fd9710897dfb4ef5663645832dc1a6fc":1,"12124c9c07b7099e1032f049ea93d6a1c674d21c":4,"32caa6b891d9a98ba3ed0ab98cc0907b124f612f":15,"36357246f1161296de8d3db5dfce38294eefbcfd":0,"06d8edea1c9729dfbe071d65a9d46dad7c662667":13,"af8b1dd972bada82080623bb88b29fce8d674321":43,"86bd0fe8018d82ff9b5e9862bfae9f6e5be6727a":9,"b901ab8504d8e9744fd6a9fa1b05c57821f942fd":159,"248b6a0829d01050121b4ebbc8f0a41939be123b":11,"f256d2d2a82077459faad2fc03fbc1c8e650cf83":9,"c6fe4c3324a7b832c8e43b9117bc797f8e598639":64,"a0c1eacaae62751ef49fcb12a3801136314af286":14,"97b2dfa125f48dfb408cefa2f6c26d27abdf7031":118,"e912df728aa25a342e619badacc5742f5edd0d97":55,"082f7237db2664ed722be1d9d5c5642677390fd1":29,"7554c8234230312e985937b221d11c4659660b2d":126,"ece097490f6bc37c7f12a0d0807d96d5d07a3cc0":9,"320f6e940a4b765c0999ceae009bfbee907661af":0,"0ae526dc0c1aabc5ac0c25bf15876c5544383735":29,"7bdf4b5927d7b0662d92ac2957e924819ad95261":27,"e7a48b0b0c3139384d804b1582a44dd4a2f65789":0,"ad6515f52e89a2344b92a2a72eb4946ce4048a9c":55,"18b6c5ed4a93ee832758b99c61851a1fc96cab70":31,"71d6012d6dda3c919914740ecfb9abd682b85d0d":12,"b5204cac022a231a50a372236d424ae1d9775b15":73,"6661e95e52e74ad59432906ba95f0dcc51e86712":9,"292d3d596e627f8a52eca2d32461c4ead0ea0dba":9,"2170eecada64976b7494cf743c0c2480f7164ed3":7,"260dfdca464e99d9bc44b569b6d15a9904f11137":103,"4d2db0d1a77a4c772216add21b1f9b54dc23619f":27,"d7e13d0dd2f400ffbabdb08a1d506737f3ff00fb":41,"252c2a35ecd83a33bcc369ae1ef361fb9c9844b1":35,"a5805045c33cea6b9a0557fe0f9eaf72ecbf627a":17,"aec8d361f6e9c6cbce722e2c5dd47a4ca4b20543":26,"712a9c3b45df8e5985fca7eed56fbff3b69d6c1e":179,"4df803338ae3daa718b59698ce3e3a4bd994e5af":65,"1665a2f8071591cb4a4c26d475ea1bf8709481c7":15,"27e2c31818f48538c90eaae5b6d4688bc545a5f3":43,"f895ec7d6c922a8b03dab9baa4ece11115ee60ba":11,"14dfc658a352d6a1265d54084e1e611d02167c40":19,"21e7b4357a3108597d85a4f02b2c7ef94c8c55b9":10,"a2a5c941bb582fa78c27cbe10174ce5a6c9dd8e1":153,"5386de7d2b358c5c51c3c8278c1bd9881079041e":19,"d0d1a48cf583ac02aa32b0befbfd2c6230aad455":36,"9a56afec92b5ba2478355da34acb7a18bdb24752":45,"59ce2a406bee80a7cb53b6b712414c1b245d4c4c":83,"7270c456bb6687cf9d9d96b32307ba755ceab1d6":79,"e4dcab9a0f1e343c3208cb9c1fa14f001127d907":41,"6df03d2ba3554471cad37ecef4bef61c52e43876":57,"b079936ac201dfa4595d74d7a7be49b0bdafed5c":25,"8e9aa3081e9a32b8d46654e6a1db3fb570f7b85b":7,"6d9421254826aa6e744a9ef5307491f2335da487":98,"38db524c7e067889177c9e32477c9faf585ae8d1":32,"bcd245d0be34bbbe2e65af426cf32370ee00df91":18,"011ca133971f2d5da85e2d457b2805104c92d653":18,"48d843e0c4c02380155905d2db7a9e90a49ba602":161,"47ec09fa2d24554ac3638fdf8e7763d332f9519b":120,"c54f58bf9965ce447a1df97c6cfd17982e6c6091":61,"378fcc2df22ee17afbc40385bf78b2ac9ce1664a":25,"5534bb01e2a831310619262d9e23d2db321b2f77":6,"f66a3c5e57dbe6dd104c55e51a9917cbe8924af6":85,"b9e3194128726ff51d0854ae266c888451b55520":72,"ce5c44b7b37601276ed9cfda1e68265f4cd8d5dc":65,"73a9b23cffd7f05f0ad4e7d7f1ab60fdfa9420cf":49,"f849e011555a01a2b69304652089d3ca93110621":51,"ac84aff8ad3a508aa7a798558b4e7956a96e3d1e":58,"e0ffe03fa8ce47ef0bddc91ec6c9cf46555c1a27":12,"ebff9af0054e02be5153ae344b36f1efb3f6d3c7":44,"dda07ace4ceb83fb11120b6ca1ecc60177494ecd":38,"dd9e81cd8ab6f9ed0d85d5d9ee1d3462b7b0739d":34,"d3c5143b167a6997e09119378e9b30413be887c0":8,"c7ba3e8137dc2438fd55ffa855f7bdb8887bb240":10,"f1b84282a12ed1d30b9600ede08e6f4b4002b521":73,"7e1f7f4e3367362dc01fa24c0b4ea9ecfb319644":8,"8110d1d19a7f5775170c73466b45cc0e33b8918d":0,"0c65150034fccb03e5a9e0d9c7e8aff27ed1f43f":46,"fe534a3dfe2f6ebe0abd5aee9b9a2712454593f7":12,"799dc8c82600cb59b41bd521a611bfac5efdf5ac":12,"d09aee3af5982f7119885da4044b5391329d24ce":0,"e8e17040b49b087ec0860dad021727c9475458cf":0,"4d7cf36c469c31c006c18676bb1f76410633c1fc":53,"2669cc8df5f05fd70e0fba47ecca2d273a59a61b":41,"7a4e1190d5df2ec25ca0799b3ac493aa58f5c691":21,"74844306da2de2afe893ff9832e86669e61287aa":50,"bdc0c08ee9e274409df77afe33ca5501196a7264":16,"f45e19e35053621e228fad4a159e5b5c89179064":30,"3b9e92bb94e3bd4154cb408674256f0b43291b7c":6,"34d42bacf18993389fc69aa8a9033e0bff777340":19,"48e4a4b91f0ca721e74b91da2449df2d2531c9b4":167,"ee84b23632a030f62f2bc7c7db8c6b053f692b3f":881,"6b93e209ea806e5c07615c554ba349a83c9307c5":8,"e77c4657c7a524b4c6bf7a6afe5a14e1de44b190":2,"68f7fcdac176a0cb0b8a2c8721afdc18e66fc027":1421,"f8ed2883526bddef80145991b0f4003b40fed80a":8,"352a2427fe63bb8e5562b33f919cd5db9d084c08":29,"656055b5a359835d50457447b9db5d84d9ddc3ad":30,"1fe93229873ac2ce2963d0c1834af5d499a224ae":2,"078e99e92523f560b7a41f0d32319a8679c12a4b":79,"ff4602301c7a4066debb4660b2cf0493f9ddae78":50,"ec2e26312d1464f02b3ac79d9c96d56920c8367e":34,"0842e8310c2f32530cff723a0e9cfd2330394697":6,"e97f6a8ce9dae10e4c010f5263b5a83234894ac1":54,"9b4de028df02ef944bae7bff88c2845de91abf0d":101,"2ac2fc5088f297ae0f0b00b319b420d450c710a7":64,"a8074f6ccca3f3c7a48bdc2aa762ea90177b1b87":25,"e90ea2e7d9288691773ea777ed5f4dffe4b5f6f3":34,"80a8cedc3fc2d49185d00e1c7ed03f2cbb8cc8ab":47,"079223c1ff5209fba979fad03f8178f7e3c03886":19,"6afebd641798d002d60f4bc883c166b1e0e9ac39":27,"b2bd0b9c4ad50e37b08bc506d29b98c1edb7d3a6":46,"2451f864f3fec8ad4422f119f55359deeef24f66":43,"e08b86baa34cfb3a5182ad3681596db58c2b1642":7,"4a407fe09e1f1d24bb85f95b945d36a686ac2b57":24,"9a90e2504b881923732f6899e9a50b07899ae219":25},"tools":{"openai-codex":{"name":"OpenAI Codex","commits":139,"loc":7454,"first_seen":1747624379,"last_seen":1747970275}},"monthly":{"2025-05":{"loc":7601,"attributed_loc":7454}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1747621380.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1747621380}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":133.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":7601.0,"flagged_loc":1421.0,"flagged_loc_share":0.18694908564662543,"max_loc_per_hour":2842.0,"median_loc_per_hour":279.0,"pr_timed_units":129.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,421 lines of first-party code in ~0.5h (2,842 lines/hour, PR #129)","ref":"68f7fcdac176a0cb0b8a2c8721afdc18e66fc027","url":"https://github.com/ezyang/scubaduck/commit/68f7fcdac176a0cb0b8a2c8721afdc18e66fc027","weight":0.6}],"data":{"flagged_loc_by_commit":{"68f7fcdac176a0cb0b8a2c8721afdc18e66fc027":1421},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2673.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":33.0,"findings_high":20.0,"findings_medium":13.0,"findings_low":0.0,"weighted_findings":21.8,"scanned_lines":2673.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":62,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:62"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":67,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:67"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":73,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:73"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":81,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:81"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":439,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:439"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":467,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:467"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":503,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:503"},{"rule_id":"opengrep/python.django.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence low]","path":"scubaduck/server.py","line":504,"fingerprint":"python.django.security.injection.tainted-sql-string:scubaduck/server.py:504"},{"rule_id":"opengrep/python.flask.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"scubaduck/server.py","line":504,"fingerprint":"python.flask.security.injection.tainted-sql-string:scubaduck/server.py:504"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"scubaduck/server.py","line":656,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:scubaduck/server.py:656"},{"rule_id":"opengrep/python.django.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence low]","path":"scubaduck/server.py","line":657,"fingerprint":"python.django.security.injection.tainted-sql-string:scubaduck/server.py:657"},{"rule_id":"opengrep/python.flask.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"scubaduck/server.py","line":657,"fingerprint":"python.flask.security.injection.tainted-sql-string:scubaduck/server.py:657"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/table_view.js","line":173,"fingerprint":"javascript.browser.security.insecure-document-method:scubaduck/static/js/table_view.js:173"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `view.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/table_view.js","line":173,"fingerprint":"javascript.browser.security.insecure-innerhtml:scubaduck/static/js/table_view.js:173"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/view_settings.js","line":115,"fingerprint":"javascript.browser.security.insecure-document-method:scubaduck/static/js/view_settings.js:115"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/view_settings.js","line":115,"fingerprint":"javascript.browser.security.insecure-innerhtml:scubaduck/static/js/view_settings.js:115"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/view_settings.js","line":540,"fingerprint":"javascript.browser.security.insecure-document-method:scubaduck/static/js/view_settings.js:540"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `colSel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/view_settings.js","line":540,"fingerprint":"javascript.browser.security.insecure-innerhtml:scubaduck/static/js/view_settings.js:540"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/view_settings.js","line":564,"fingerprint":"javascript.browser.security.insecure-document-method:scubaduck/static/js/view_settings.js:564"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `opSel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scubaduck/static/js/view_settings.js","line":564,"fingerprint":"javascript.browser.security.insecure-innerhtml:scubaduck/static/js/view_settings.js:564"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"scubaduck/server.py","line":62,"fingerprint":"python.lang.security.audit.formatted-sql-query:scubaduck/server.py:62"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"scubaduck/server.py","line":67,"fingerprint":"python.lang.security.audit.formatted-sql-query:scubaduck/server.py:67"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"scubaduck/server.py","line":73,"fingerprint":"python.lang.security.audit.formatted-sql-query:scubaduck/server.py:73"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"scubaduck/server.py","line":81,"fingerprint":"python.lang.security.audit.formatted-sql-query:scubaduck/server.py:81"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"scubaduck/server.py","line":439,"fingerprint":"python.lang.security.audit.formatted-sql-query:scubaduck/server.py:439"},{"rule_id":"opengrep/python.django.security.injection.sql.sql-injection-db-cursor-execute","severity":"medium","message":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use [confidence medium]","path":"scubaduck/server.py","line":466,"fingerprint":"python.django.security.injection.sql.sql-injection-db-cursor-execute:scubaduck/server.py:466"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"scubaduck/server.py","line":467,"fingerprint":"python.lang.security.audit.formatted-sql-query:scubaduck/server.py:467"},{"rule_id":"opengrep/python.django.security.injection.sql.sql-injection-db-cursor-execute","severity":"medium","message":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use [confidence medium]","path":"scubaduck/server.py","line":489,"fingerprint":"python.django.security.injection.sql.sql-injection-db-cursor-execute:scubaduck/server.py:489"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"scubaduck/server.py","line":656,"fingerprint":"python.lang.security.audit.formatted-sql-query:scubaduck/server.py:656"},{"rule_id":"opengrep/python.flask.security.audit.debug-enabled","severity":"medium","message":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables. [confidence high]","path":"scubaduck/server.py","line":763,"fingerprint":"python.flask.security.audit.debug-enabled:scubaduck/server.py:763"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scubaduck/static/js/table_view.js","line":173,"fingerprint":"javascript.lang.security.html-in-template-string:scubaduck/static/js/table_view.js:173"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scubaduck/static/js/view_settings.js","line":540,"fingerprint":"javascript.lang.security.html-in-template-string:scubaduck/static/js/view_settings.js:540"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scubaduck/static/js/view_settings.js","line":564,"fingerprint":"javascript.lang.security.html-in-template-string:scubaduck/static/js/view_settings.js:564"}],"evidence":[],"data":{"rulesets":["javascript","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":7.0,"vulnerabilities":18.0,"vulns_critical":1.0,"vulns_high":6.0,"vulns_medium":11.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":38.0},"findings":[{"rule_id":"osv/GHSA-6q48-6c7w-9gw2","severity":"critical","message":"certifi@2025.4.26 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2","path":"uv.lock","line":null,"fingerprint":"certifi@2025.4.26 (PyPI):GHSA-6q48-6c7w-9gw2"},{"rule_id":"osv/GHSA-qccp-gfcp-xxvc","severity":"high","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-141, GHSA-qccp-gfcp-xxvc","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-qccp-gfcp-xxvc"},{"rule_id":"osv/GHSA-2xpw-w6gg-jr37","severity":"high","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1994, GHSA-2xpw-w6gg-jr37","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-2xpw-w6gg-jr37"},{"rule_id":"osv/GHSA-38jv-5279-wg99","severity":"high","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1996, GHSA-38jv-5279-wg99","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-38jv-5279-wg99"},{"rule_id":"osv/GHSA-gm62-xv2j-4w53","severity":"high","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1998, GHSA-gm62-xv2j-4w53","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-gm62-xv2j-4w53"},{"rule_id":"osv/GHSA-8988-9cw3-xx77","severity":"high","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-4175, GHSA-8988-9cw3-xx77","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-8988-9cw3-xx77"},{"rule_id":"osv/GHSA-vxq7-64xx-v4gw","severity":"high","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-4177, GHSA-vxq7-64xx-v4gw","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-vxq7-64xx-v4gw"},{"rule_id":"osv/GHSA-68rp-wp8r-4726","severity":"medium","message":"flask@3.1.1 (PyPI) is affected by PYSEC-2026-2151, GHSA-68rp-wp8r-4726","path":"uv.lock","line":null,"fingerprint":"flask@3.1.1 (PyPI):GHSA-68rp-wp8r-4726"},{"rule_id":"osv/GHSA-65pc-fj4g-8rjx","severity":"medium","message":"idna@3.10 (PyPI) is affected by PYSEC-2026-215, GHSA-65pc-fj4g-8rjx","path":"uv.lock","line":null,"fingerprint":"idna@3.10 (PyPI):GHSA-65pc-fj4g-8rjx"},{"rule_id":"osv/GHSA-6w46-j5rx-g56g","severity":"medium","message":"pytest@8.3.5 (PyPI) is affected by PYSEC-2026-1845, GHSA-6w46-j5rx-g56g","path":"uv.lock","line":null,"fingerprint":"pytest@8.3.5 (PyPI):GHSA-6w46-j5rx-g56g"},{"rule_id":"osv/GHSA-9hjg-9r4m-mvj7","severity":"medium","message":"requests@2.32.3 (PyPI) is affected by PYSEC-2026-1872, GHSA-9hjg-9r4m-mvj7","path":"uv.lock","line":null,"fingerprint":"requests@2.32.3 (PyPI):GHSA-9hjg-9r4m-mvj7"},{"rule_id":"osv/GHSA-gc5v-m9x4-r6x2","severity":"medium","message":"requests@2.32.3 (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2","path":"uv.lock","line":null,"fingerprint":"requests@2.32.3 (PyPI):GHSA-gc5v-m9x4-r6x2"},{"rule_id":"osv/GHSA-48p4-8xcf-vxj5","severity":"medium","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1997, GHSA-48p4-8xcf-vxj5","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-48p4-8xcf-vxj5"},{"rule_id":"osv/GHSA-pq67-6m6q-mj2v","severity":"medium","message":"urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1999, GHSA-pq67-6m6q-mj2v","path":"uv.lock","line":null,"fingerprint":"urllib3@2.4.0 (PyPI):GHSA-pq67-6m6q-mj2v"},{"rule_id":"osv/GHSA-87hc-h4r5-73f7","severity":"medium","message":"werkzeug@3.1.3 (PyPI) is affected by PYSEC-2026-2044, GHSA-87hc-h4r5-73f7","path":"uv.lock","line":null,"fingerprint":"werkzeug@3.1.3 (PyPI):GHSA-87hc-h4r5-73f7"},{"rule_id":"osv/GHSA-hgf8-39gv-g3f2","severity":"medium","message":"werkzeug@3.1.3 (PyPI) is affected by PYSEC-2026-2046, GHSA-hgf8-39gv-g3f2","path":"uv.lock","line":null,"fingerprint":"werkzeug@3.1.3 (PyPI):GHSA-hgf8-39gv-g3f2"},{"rule_id":"osv/GHSA-29vq-49wr-vm6x","severity":"medium","message":"werkzeug@3.1.3 (PyPI) is affected by PYSEC-2026-2320, GHSA-29vq-49wr-vm6x","path":"uv.lock","line":null,"fingerprint":"werkzeug@3.1.3 (PyPI):GHSA-29vq-49wr-vm6x"},{"rule_id":"osv/GHSA-g6x2-hccm-hh4m","severity":"medium","message":"werkzeug@3.1.3 (PyPI) is affected by PYSEC-2026-4312, GHSA-g6x2-hccm-hh4m","path":"uv.lock","line":null,"fingerprint":"werkzeug@3.1.3 (PyPI):GHSA-g6x2-hccm-hh4m"}],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":8.0,"findings_high":4.0,"findings_medium":4.0,"findings_low":0.0,"penalty":55.2},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":12,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:12"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":13,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:13"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":12,"fingerprint":"unpinned-uses:.github/workflows/test.yml:12"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":13,"fingerprint":"unpinned-uses:.github/workflows/test.yml:13"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/lint.yml","line":12,"fingerprint":"artipacked:.github/workflows/lint.yml:12"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/lint.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/lint.yml:9"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":12,"fingerprint":"artipacked:.github/workflows/test.yml:12"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/test.yml:9"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.8931,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":189.0,"function_nloc":2611.0,"mean_ccn":3.31,"p90_ccn":7.0,"complex_functions":7.0,"long_functions":2.0,"many_param_functions":0.0,"risky_nloc_share":0.3895},"findings":[],"evidence":[{"kind":"complex-function","description":"_quote in scubaduck/server.py: complexity 33, 725 lines","ref":"scubaduck/server.py","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/server.py#L21","weight":0.55},{"kind":"complex-function","description":"paramsToSearch in scubaduck/static/js/view_settings.js: complexity 32, 29 lines","ref":"scubaduck/static/js/view_settings.js","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/static/js/view_settings.js#L747","weight":0.5333333333333333},{"kind":"complex-function","description":"applyParams in scubaduck/static/js/view_settings.js: complexity 25, 53 lines","ref":"scubaduck/static/js/view_settings.js","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/static/js/view_settings.js#L777","weight":0.4166666666666667},{"kind":"complex-function","description":"parseSearch in scubaduck/static/js/view_settings.js: complexity 23, 29 lines","ref":"scubaduck/static/js/view_settings.js","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/static/js/view_settings.js#L879","weight":0.38333333333333336},{"kind":"complex-function","description":"showTimeSeries in scubaduck/static/js/timeseries_chart.js: complexity 19, 135 lines","ref":"scubaduck/static/js/timeseries_chart.js","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/static/js/timeseries_chart.js#L4","weight":0.31666666666666665},{"kind":"complex-function","description":"(anonymous) in scubaduck/static/js/time_column.js: complexity 16, 12 lines","ref":"scubaduck/static/js/time_column.js","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/static/js/time_column.js#L6","weight":0.26666666666666666},{"kind":"complex-function","description":"(anonymous) in scubaduck/static/js/view_settings.js: complexity 16, 34 lines","ref":"scubaduck/static/js/view_settings.js","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/static/js/view_settings.js#L246","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2174.0,"duplicated_lines":41.0,"duplicated_share":0.0189,"files":10.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scubaduck/server.py:229 and scubaduck/server.py:578","ref":"scubaduck/server.py","url":"https://github.com/ezyang/scubaduck/blob/00a2a565b7ebe537c883bffab7698b956f1738a2/scubaduck/server.py#L229","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"weighted_findings":22.0,"scanned_lines":2673.0,"category:maintainability":10.0},"findings":[{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `index` is defined inside a function but never used","path":"scubaduck/server.py","line":449,"fingerprint":"python.lang.maintainability.useless-inner-function:scubaduck/server.py:449"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `js` is defined inside a function but never used","path":"scubaduck/server.py","line":454,"fingerprint":"python.lang.maintainability.useless-inner-function:scubaduck/server.py:454"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `tables_endpoint` is defined inside a function but never used","path":"scubaduck/server.py","line":460,"fingerprint":"python.lang.maintainability.useless-inner-function:scubaduck/server.py:460"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `columns` is defined inside a function but never used","path":"scubaduck/server.py","line":464,"fingerprint":"python.lang.maintainability.useless-inner-function:scubaduck/server.py:464"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `sample_values` is defined inside a function but never used","path":"scubaduck/server.py","line":487,"fingerprint":"python.lang.maintainability.useless-inner-function:scubaduck/server.py:487"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `query` is defined inside a function but never used","path":"scubaduck/server.py","line":511,"fingerprint":"python.lang.maintainability.useless-inner-function:scubaduck/server.py:511"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"scubaduck/server.py","line":40,"fingerprint":"python.lang.maintainability.return-not-in-function:scubaduck/server.py:40"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"scubaduck/server.py","line":41,"fingerprint":"python.lang.maintainability.return-not-in-function:scubaduck/server.py:41"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"scubaduck/server.py","line":42,"fingerprint":"python.lang.maintainability.return-not-in-function:scubaduck/server.py:42"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"scubaduck/server.py","line":44,"fingerprint":"python.lang.maintainability.return-not-in-function:scubaduck/server.py:44"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":2876.0,"source_lines":2673.0,"test_ratio":1.0759,"ci_files":2.0,"cochange_share":0.8046,"cochange_commits":87.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/lint.yml","ref":".github/workflows/lint.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff, pyright)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest"],"lint_commands":["ruff","pyright"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":95.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":17.0,"escapes_per_kloc":17.0},"findings":[],"evidence":[{"kind":"typing","description":"Python strict type checking: pyproject.toml","ref":"pyproject.toml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2658.0,"other_lines":15.0,"files_blamed":10.0,"blame_failures":0.0,"quality:ai_findings":10.0,"quality:ai_per_kloc":3.762,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":33.0,"security:ai_per_kloc":12.415,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}