{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:07:01.159737Z","repo":{"ref":{"host":"github.com","owner":"github","name":"auto-check-element"},"default_branch":"main","clone_url":"https://github.com/github/auto-check-element.git","html_url":"https://github.com/github/auto-check-element","description":"An input element that validates its value with a server endpoint.","stars":189,"forks":37,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1653,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2018-04-05T14:05:49Z","pushed_at":"2026-11-13T18:22:41Z","security_policy_url":"https://github.com/github/auto-check-element/security/policy","distribution":{"owner_created_at":"2008-05-11T04:37:31Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"f45736d04f7eedf9f22bc9294f9ebff462e81dbd","profile":{"lines_by_language":{"JavaScript":548,"TypeScript":413},"files_by_category":{"config":9,"source":5,"other":3,"docs":2,"generated":1,"test":1},"source_lines":454,"test_lines":507},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals."},"quality":{"score":83.7,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":48.6,"duplication":100.0,"lint":100.0,"testing":90.0,"docs":65.0,"type_safety":100.0,"process":100.0},"summary":"Code quality is strong: test-to-source ratio 1.12, CI runs tests; 24% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity."},"security":{"score":80.3,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":100.0,"dependencies":22.7,"ci_actions":90.5,"posture":100.0,"scorecard":71.4},"summary":"Security posture is adequate: 26 known vulnerabilities in 17 dependencies; 1 high-severity workflow issues. Weakest area: dependencies."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":8.1,"check:Dangerous-Workflow":10.0,"check:Maintained":10.0,"check:Binary-Artifacts":10.0,"check:Code-Review":10.0,"check:Token-Permissions":9.0,"check:Pinned-Dependencies":7.0,"check:CII-Best-Practices":0.0,"check:Fuzzing":0.0,"check:License":10.0,"check:Security-Policy":10.0,"check:Branch-Protection":6.0,"check:SAST":8.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)","ref":"Dangerous-Workflow","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Maintained: 10/10 (19 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 10/10 (all changesets reviewed)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Token-Permissions: 9/10 (detected GitHub workflow tokens with excessive permissions)","ref":"Token-Permissions","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.1},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 7/10 (dependency not pinned by hash detected -- score normalized to 7)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.3},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 10/10 (security policy file detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 6/10 (branch protection is not maximal on development and all release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.4},{"kind":"scorecard-check","description":"Scorecard SAST: 8/10 (SAST tool is not run on all commits -- score normalized to 8)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/github/auto-check-element","weight":0.2}],"data":{"date":"2026-11-09","commit":"f4487e3552e193bc81bb5f5c1eb9530576355849","matches_head":false},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":12.0,"checked":12.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":342.0,"attributed_commits":7.0,"attributed_commit_share":0.02046783625730994,"effective_loc":2492.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 7 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"a435daa57fd5ca92d921cb3069238b84f800e9ec","url":"https://github.com/github/auto-check-element/commit/a435daa57fd5ca92d921cb3069238b84f800e9ec","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"7395c645c9bc641bac9ed224edd3e223bf70b96a","url":"https://github.com/github/auto-check-element/commit/7395c645c9bc641bac9ed224edd3e223bf70b96a","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"6a1a8d3f2bd8cd00127f2c85bf992e3fe124ed2f","url":"https://github.com/github/auto-check-element/commit/6a1a8d3f2bd8cd00127f2c85bf992e3fe124ed2f","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"9fea93fa4ad582b8133c99475fdf9a12406359a4","url":"https://github.com/github/auto-check-element/commit/9fea93fa4ad582b8133c99475fdf9a12406359a4","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"b9c3a92f627321d34360abd3547b969c192732c3","url":"https://github.com/github/auto-check-element/commit/b9c3a92f627321d34360abd3547b969c192732c3","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"3356d05d7933124e7de0d64474ecadba53c7a980","url":"https://github.com/github/auto-check-element/commit/3356d05d7933124e7de0d64474ecadba53c7a980","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"ca09d3a31c10f261ad93fdcd706a0d7bc1dcf9b7","url":"https://github.com/github/auto-check-element/commit/ca09d3a31c10f261ad93fdcd706a0d7bc1dcf9b7","weight":0.9}],"data":{"attributed_loc_by_commit":{"ca09d3a31c10f261ad93fdcd706a0d7bc1dcf9b7":0,"3356d05d7933124e7de0d64474ecadba53c7a980":0,"b9c3a92f627321d34360abd3547b969c192732c3":0,"9fea93fa4ad582b8133c99475fdf9a12406359a4":0,"6a1a8d3f2bd8cd00127f2c85bf992e3fe124ed2f":0,"7395c645c9bc641bac9ed224edd3e223bf70b96a":0,"a435daa57fd5ca92d921cb3069238b84f800e9ec":0},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":7,"loc":0,"first_seen":1736542064,"last_seen":1794593905}},"monthly":{"2018-03":{"loc":0,"attributed_loc":0},"2018-04":{"loc":509,"attributed_loc":0},"2018-05":{"loc":20,"attributed_loc":0},"2018-07":{"loc":2,"attributed_loc":0},"2018-08":{"loc":135,"attributed_loc":0},"2019-01":{"loc":2,"attributed_loc":0},"2019-02":{"loc":2,"attributed_loc":0},"2019-03":{"loc":17,"attributed_loc":0},"2019-04":{"loc":0,"attributed_loc":0},"2019-05":{"loc":118,"attributed_loc":0},"2019-06":{"loc":0,"attributed_loc":0},"2019-07":{"loc":77,"attributed_loc":0},"2019-08":{"loc":25,"attributed_loc":0},"2019-09":{"loc":107,"attributed_loc":0},"2019-10":{"loc":684,"attributed_loc":0},"2019-11":{"loc":34,"attributed_loc":0},"2019-12":{"loc":19,"attributed_loc":0},"2020-01":{"loc":35,"attributed_loc":0},"2020-02":{"loc":0,"attributed_loc":0},"2020-04":{"loc":1,"attributed_loc":0},"2020-05":{"loc":68,"attributed_loc":0},"2020-06":{"loc":3,"attributed_loc":0},"2021-03":{"loc":0,"attributed_loc":0},"2021-04":{"loc":0,"attributed_loc":0},"2021-08":{"loc":20,"attributed_loc":0},"2022-01":{"loc":2,"attributed_loc":0},"2022-02":{"loc":0,"attributed_loc":0},"2022-03":{"loc":0,"attributed_loc":0},"2022-09":{"loc":0,"attributed_loc":0},"2023-04":{"loc":222,"attributed_loc":0},"2023-06":{"loc":0,"attributed_loc":0},"2023-07":{"loc":1,"attributed_loc":0},"2023-08":{"loc":0,"attributed_loc":0},"2024-02":{"loc":0,"attributed_loc":0},"2024-05":{"loc":82,"attributed_loc":0},"2024-06":{"loc":0,"attributed_loc":0},"2024-09":{"loc":0,"attributed_loc":0},"2024-11":{"loc":145,"attributed_loc":0},"2024-12":{"loc":40,"attributed_loc":0},"2025-01":{"loc":55,"attributed_loc":0},"2025-02":{"loc":0,"attributed_loc":0},"2025-03":{"loc":26,"attributed_loc":0},"2025-04":{"loc":0,"attributed_loc":0},"2025-09":{"loc":0,"attributed_loc":0},"2025-10":{"loc":0,"attributed_loc":0},"2025-11":{"loc":0,"attributed_loc":0},"2026-02":{"loc":0,"attributed_loc":0},"2026-04":{"loc":0,"attributed_loc":0},"2026-05":{"loc":0,"attributed_loc":0},"2026-06":{"loc":0,"attributed_loc":0},"2026-07":{"loc":0,"attributed_loc":0},"2026-08":{"loc":0,"attributed_loc":0},"2026-09":{"loc":0,"attributed_loc":0},"2026-10":{"loc":41,"attributed_loc":0},"2026-11":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":79.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":1858.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2492.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":131.62283515073767,"median_loc_per_hour":57.9995374653099,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":34.0,"flagged_releases":0.0,"max_loc_per_day":131.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1.0","to":"v0.1.1","loc":28,"days":3.71,"loc_per_day":7.5,"flagged":false},{"from":"v0.1.1","to":"v0.2.0","loc":20,"days":44.01,"loc_per_day":0.5,"flagged":false},{"from":"v0.2.0","to":"v0.2.1","loc":2,"days":50.94,"loc_per_day":0.0,"flagged":false},{"from":"v0.2.1","to":"v0.3.0","loc":135,"days":32.03,"loc_per_day":4.2,"flagged":false},{"from":"v0.3.0","to":"v1.0.0","loc":4,"days":184.07,"loc_per_day":0.0,"flagged":false},{"from":"v1.0.0","to":"v2.0.0","loc":17,"days":63.62,"loc_per_day":0.3,"flagged":false},{"from":"v2.0.0","to":"v3.0.0","loc":118,"days":24.33,"loc_per_day":4.8,"flagged":false},{"from":"v3.0.0","to":"v3.0.1","loc":0,"days":3.09,"loc_per_day":0.0,"flagged":false},{"from":"v3.0.1","to":"v3.0.2","loc":0,"days":66.91,"loc_per_day":0.0,"flagged":false},{"from":"v3.0.2","to":"v4.0.0-beta.1","loc":6,"days":0.05,"loc_per_day":131.5,"flagged":false},{"from":"v4.0.0-beta.1","to":"v4.0.0","loc":65,"days":8.05,"loc_per_day":8.1,"flagged":false},{"from":"v4.0.0","to":"4.0.1","loc":0,"days":2.85,"loc_per_day":0.0,"flagged":false},{"from":"4.0.1","to":"v4.0.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v4.0.1","to":"4.0.2","loc":7,"days":9.99,"loc_per_day":0.7,"flagged":false},{"from":"4.0.2","to":"v4.0.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v4.0.2","to":"4.1.0","loc":24,"days":8.01,"loc_per_day":3.0,"flagged":false},{"from":"4.1.0","to":"v4.1.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v4.1.0","to":"v4.1.1","loc":6,"days":16.1,"loc_per_day":0.4,"flagged":false},{"from":"v4.1.1","to":"v5.0.0","loc":806,"days":70.18,"loc_per_day":11.5,"flagged":false},{"from":"v5.0.0","to":"v5.0.1","loc":13,"days":4.99,"loc_per_day":2.6,"flagged":false},{"from":"v5.0.1","to":"v5.0.2","loc":19,"days":14.31,"loc_per_day":1.3,"flagged":false},{"from":"v5.0.2","to":"v5.1.0","loc":31,"days":33.79,"loc_per_day":0.9,"flagged":false},{"from":"v5.1.0","to":"v5.1.1","loc":4,"days":13.85,"loc_per_day":0.3,"flagged":false},{"from":"v5.1.1","to":"v5.1.2","loc":1,"days":67.23,"loc_per_day":0.0,"flagged":false},{"from":"v5.1.2","to":"v5.1.3","loc":68,"days":61.12,"loc_per_day":1.1,"flagged":false},{"from":"v5.1.3","to":"v5.2.0","loc":23,"days":426.48,"loc_per_day":0.1,"flagged":false},{"from":"v5.2.0","to":"v5.3.0","loc":2,"days":609.34,"loc_per_day":0.0,"flagged":false},{"from":"v5.3.0","to":"v5.4.0","loc":222,"days":20.91,"loc_per_day":10.6,"flagged":false},{"from":"v5.4.0","to":"v5.4.1","loc":1,"days":69.89,"loc_per_day":0.0,"flagged":false},{"from":"v5.4.1","to":"v5.4.2","loc":82,"days":329.18,"loc_per_day":0.2,"flagged":false},{"from":"v5.4.2","to":"v5.5.0","loc":145,"days":181.19,"loc_per_day":0.8,"flagged":false},{"from":"v5.5.0","to":"v5.5.1","loc":40,"days":14.89,"loc_per_day":2.7,"flagged":false},{"from":"v5.5.1","to":"v5.6.0","loc":55,"days":32.98,"loc_per_day":1.7,"flagged":false},{"from":"v5.6.0","to":"v6.0.0","loc":26,"days":69.82,"loc_per_day":0.4,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":454.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":454.0,"parse_errors":0.0},"findings":[],"evidence":[],"data":{"rulesets":["typescript","javascript","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":17.0,"vulnerabilities":26.0,"vulns_critical":0.0,"vulns_high":11.0,"vulns_medium":13.0,"vulns_low":2.0,"vulns_unknown":0.0,"penalty":89.0},"findings":[{"rule_id":"osv/GHSA-c475-qrg2-pj4r","severity":"high","message":"basic-ftp@5.2.2 (npm) is affected by GHSA-c475-qrg2-pj4r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.2 (npm):GHSA-c475-qrg2-pj4r"},{"rule_id":"osv/GHSA-rp42-5vxx-qpwr","severity":"high","message":"basic-ftp@5.2.2 (npm) is affected by GHSA-rp42-5vxx-qpwr","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.2 (npm):GHSA-rp42-5vxx-qpwr"},{"rule_id":"osv/GHSA-rpmf-866q-6p89","severity":"high","message":"basic-ftp@5.2.2 (npm) is affected by GHSA-rpmf-866q-6p89","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.2 (npm):GHSA-rpmf-866q-6p89"},{"rule_id":"osv/GHSA-3xgq-45jj-v275","severity":"high","message":"cross-spawn@7.0.3 (npm) is affected by GHSA-3xgq-45jj-v275","path":"package-lock.json","line":null,"fingerprint":"cross-spawn@7.0.3 (npm):GHSA-3xgq-45jj-v275"},{"rule_id":"osv/GHSA-7pqw-9j4j-h8q3","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-7pqw-9j4j-h8q3","path":"package-lock.json","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-7pqw-9j4j-h8q3"},{"rule_id":"osv/GHSA-jmr9-qjv8-65gv","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-jmr9-qjv8-65gv","path":"package-lock.json","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-jmr9-qjv8-65gv"},{"rule_id":"osv/GHSA-7gcc-r8m5-44qm","severity":"high","message":"koa@2.16.1 (npm) is affected by GHSA-7gcc-r8m5-44qm","path":"package-lock.json","line":null,"fingerprint":"koa@2.16.1 (npm):GHSA-7gcc-r8m5-44qm"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-mw96-cpmx-2vgc","severity":"high","message":"rollup@4.22.4 (npm) is affected by GHSA-mw96-cpmx-2vgc","path":"package-lock.json","line":null,"fingerprint":"rollup@4.22.4 (npm):GHSA-mw96-cpmx-2vgc"},{"rule_id":"osv/GHSA-c2qf-rxjj-qqgw","severity":"high","message":"semver@6.3.0 (npm) is affected by GHSA-c2qf-rxjj-qqgw","path":"package-lock.json","line":null,"fingerprint":"semver@6.3.0 (npm):GHSA-c2qf-rxjj-qqgw"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.23.8 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@3.23.8 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-968p-4wvh-cqc8","severity":"medium","message":"@babel/runtime@7.21.0 (npm) is affected by GHSA-968p-4wvh-cqc8","path":"package-lock.json","line":null,"fingerprint":"@babel/runtime@7.21.0 (npm):GHSA-968p-4wvh-cqc8"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"package-lock.json","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-5pm8-86m8-9m6r","severity":"medium","message":"basic-ftp@5.2.2 (npm) is affected by GHSA-5pm8-86m8-9m6r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.2 (npm):GHSA-5pm8-86m8-9m6r"},{"rule_id":"osv/GHSA-r4jh-29pc-gfqr","severity":"medium","message":"basic-ftp@5.2.2 (npm) is affected by GHSA-r4jh-29pc-gfqr","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.2 (npm):GHSA-r4jh-29pc-gfqr"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.17.19 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.17.19 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.7.3 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.7.3 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-952p-6rrq-rcjv","severity":"medium","message":"micromatch@4.0.5 (npm) is affected by GHSA-952p-6rrq-rcjv","path":"package-lock.json","line":null,"fingerprint":"micromatch@4.0.5 (npm):GHSA-952p-6rrq-rcjv"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.15.2 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.2 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.15.2 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.2 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.15.2 (npm) is affected by GHSA-x5fp-wj9c-mxmx","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.2 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-j8xg-fqg3-53r7","severity":"medium","message":"word-wrap@1.2.3 (npm) is affected by GHSA-j8xg-fqg3-53r7","path":"package-lock.json","line":null,"fingerprint":"word-wrap@1.2.3 (npm):GHSA-j8xg-fqg3-53r7"},{"rule_id":"osv/GHSA-73rr-hh4g-fpgx","severity":"low","message":"diff@5.1.0 (npm) is affected by GHSA-73rr-hh4g-fpgx","path":"package-lock.json","line":null,"fingerprint":"diff@5.1.0 (npm):GHSA-73rr-hh4g-fpgx"},{"rule_id":"osv/GHSA-jgmv-j7ww-jx2x","severity":"low","message":"koa@2.16.1 (npm) is affected by GHSA-jgmv-j7ww-jx2x","path":"package-lock.json","line":null,"fingerprint":"koa@2.16.1 (npm):GHSA-jgmv-j7ww-jx2x"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":3.0,"findings_high":1.0,"findings_medium":2.0,"findings_low":0.0,"penalty":6.0},"findings":[{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish.yml","line":15,"fingerprint":"cache-poisoning:.github/workflows/publish.yml:15"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/nodejs.yml","line":10,"fingerprint":"artipacked:.github/workflows/nodejs.yml:10"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":14,"fingerprint":"artipacked:.github/workflows/publish.yml:14"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":1.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.805,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: https://github.com/github/auto-check-element/security/policy","ref":"https://github.com/github/auto-check-element/security/policy","url":null,"weight":0.0},{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":38.0,"function_nloc":283.0,"mean_ccn":2.63,"p90_ccn":5.0,"complex_functions":1.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.2403},"findings":[],"evidence":[{"kind":"complex-function","description":"check in src/auto-check-element.ts: complexity 16, 68 lines","ref":"src/auto-check-element.ts","url":"https://github.com/github/auto-check-element/blob/f45736d04f7eedf9f22bc9294f9ebff462e81dbd/src/auto-check-element.ts#L292","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":289.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":5.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":454.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":507.0,"source_lines":454.0,"test_ratio":1.1167,"ci_files":2.0,"cochange_share":0.252,"cochange_commits":123.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/nodejs.yml","ref":".github/workflows/nodejs.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/publish.yml","ref":".github/workflows/publish.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":118.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":0.0,"other_lines":454.0,"files_blamed":5.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":0.0,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}