{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:05.054813Z","repo":{"ref":{"host":"github.com","owner":"hfziqi","name":"aitos"},"default_branch":"main","clone_url":"https://github.com/hfziqi/aitos.git","html_url":"https://github.com/hfziqi/aitos","description":"AI-Native Application Framework - Build apps with atomic composition and graph execution","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1690,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-04-19T12:44:29Z","pushed_at":"2026-08-16T12:40:58Z","security_policy_url":null,"distribution":{"owner_created_at":"2025-06-07T18:15:07Z","owner_type":"User","release_assets":[]}},"commit_sha":"53f7c759f3d9ebcf89e841e76b69f07bc542103d","profile":{"lines_by_language":{"TypeScript":7360},"files_by_category":{"source":44,"config":18,"generated":8,"docs":3,"binary":2},"source_lines":7360,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.42,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.2607,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":46.2,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":65.7,"duplication":48.9,"lint":77.5,"testing":0.0,"docs":65.0,"type_safety":60.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 14% of function code in complex or long functions; 12% duplicated lines. Weakest area: testing."},"security":{"score":80.7,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":77.7,"dependencies":100.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 2 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":2.0,"checked":2.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":9.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":10591.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-05":{"loc":7830,"attributed_loc":0},"2026-08":{"loc":2761,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":3.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":3698.0,"flagged_loc":2761.0,"flagged_loc_share":0.7466197944835046,"max_loc_per_hour":690.25,"median_loc_per_hour":451.375,"pr_timed_units":0.0,"excluded_import_loc":6893.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,761 lines of first-party code in ~4.0h (690 lines/hour, 1 commit session)","ref":"5276717a521675e991aa1007f9392d94f5809484","url":"https://github.com/hfziqi/aitos/commit/5276717a521675e991aa1007f9392d94f5809484","weight":0.207075}],"data":{"flagged_loc_by_commit":{"5276717a521675e991aa1007f9392d94f5809484":2761},"excluded_import_commits":["bb4568f2904d2c67b70cb36f40e3c5fbd367265a"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7360.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":18.0,"findings_high":2.0,"findings_medium":15.0,"findings_low":1.0,"weighted_findings":5.312,"scanned_lines":7360.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/@aitos/output/visual.ts","line":1295,"fingerprint":"javascript.browser.security.insecure-document-method:packages/@aitos/output/visual.ts:1295"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/@aitos/output/visual.ts","line":1295,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/@aitos/output/visual.ts:1295"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"packages/@aitos/core/src/runtime.ts","line":454,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:packages/@aitos/core/src/runtime.ts:454"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/core/src/runtime.ts","line":489,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/core/src/runtime.ts:489"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":52,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:52"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":69,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:69"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":79,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:79"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":131,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:131"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":138,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:138"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":180,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:180"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":250,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:250"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":258,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:258"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":261,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:261"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":274,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:274"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":282,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:282"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":285,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:285"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/@aitos/output/markdown.ts","line":309,"fingerprint":"javascript.lang.security.html-in-template-string:packages/@aitos/output/markdown.ts:309"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"packages/@aitos/core/src/atoms/control.ts","line":252,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:packages/@aitos/core/src/atoms/control.ts:252"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.2222,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"packages/@aitos/3d/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/@aitos/3d/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":348.0,"function_nloc":3709.0,"mean_ccn":3.41,"p90_ccn":6.0,"complex_functions":7.0,"long_functions":2.0,"many_param_functions":0.0,"risky_nloc_share":0.1399},"findings":[],"evidence":[{"kind":"complex-function","description":"decompileNode in packages/@aitos/core/src/acs.ts: complexity 36, 60 lines","ref":"packages/@aitos/core/src/acs.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/acs.ts#L662","weight":0.6},{"kind":"complex-function","description":"execute in packages/@aitos/core/src/atoms/tool-calls.ts: complexity 31, 105 lines","ref":"packages/@aitos/core/src/atoms/tool-calls.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/atoms/tool-calls.ts#L36","weight":0.5166666666666667},{"kind":"complex-function","description":"compileNodes in packages/@aitos/core/src/acs.ts: complexity 30, 96 lines","ref":"packages/@aitos/core/src/acs.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/acs.ts#L518","weight":0.5},{"kind":"complex-function","description":"execute in packages/@aitos/output/markdown.ts: complexity 25, 108 lines","ref":"packages/@aitos/output/markdown.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/output/markdown.ts#L193","weight":0.4166666666666667},{"kind":"complex-function","description":"validateGraphNodes in packages/@aitos/core/src/runtime.ts: complexity 24, 48 lines","ref":"packages/@aitos/core/src/runtime.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/runtime.ts#L125","weight":0.4},{"kind":"complex-function","description":"handler in packages/@aitos/input/pointer.ts: complexity 20, 53 lines","ref":"packages/@aitos/input/pointer.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/input/pointer.ts#L118","weight":0.3333333333333333},{"kind":"complex-function","description":"execute in packages/@aitos/core/src/atoms/control.ts: complexity 18, 49 lines","ref":"packages/@aitos/core/src/atoms/control.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/atoms/control.ts#L165","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5148.0,"duplicated_lines":614.0,"duplicated_share":0.1193,"files":44.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/bridge/atoms/imap.ts:21 and packages/@aitos/bridge/atoms/smtp.ts:24","ref":"packages/@aitos/bridge/atoms/imap.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/bridge/atoms/imap.ts#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/bridge/atoms/window.ts:12 and packages/@aitos/bridge/atoms/window.ts:37","ref":"packages/@aitos/bridge/atoms/window.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/bridge/atoms/window.ts#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/core/src/acs.ts:238 and packages/@aitos/core/src/acs.ts:259","ref":"packages/@aitos/core/src/acs.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/acs.ts#L238","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/core/src/atoms/calculation.ts:5 and packages/@aitos/core/src/atoms/calculation.ts:21","ref":"packages/@aitos/core/src/atoms/calculation.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/atoms/calculation.ts#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/core/src/atoms/control.ts:88 and packages/@aitos/core/src/atoms/manipulation.ts:234","ref":"packages/@aitos/core/src/atoms/control.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/atoms/control.ts#L88","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/core/src/atoms/control.ts:172 and packages/@aitos/core/src/atoms/control.ts:344","ref":"packages/@aitos/core/src/atoms/control.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/atoms/control.ts#L172","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/core/src/atoms/judgment.ts:21 and packages/@aitos/core/src/atoms/judgment.ts:37","ref":"packages/@aitos/core/src/atoms/judgment.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/atoms/judgment.ts#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/core/src/atoms/manipulation.ts:237 and packages/@aitos/core/src/atoms/manipulation.ts:285","ref":"packages/@aitos/core/src/atoms/manipulation.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/atoms/manipulation.ts#L237","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/core/src/runtime.ts:378 and packages/@aitos/core/src/runtime.ts:405","ref":"packages/@aitos/core/src/runtime.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/core/src/runtime.ts#L378","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/@aitos/input/pointer.ts:11 and packages/@aitos/input/pointer.ts:45","ref":"packages/@aitos/input/pointer.ts","url":"https://github.com/hfziqi/aitos/blob/53f7c759f3d9ebcf89e841e76b69f07bc542103d/packages/@aitos/input/pointer.ts#L11","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"weighted_findings":7.5,"scanned_lines":7360.0,"category:best-practice":3.0,"category:correctness":6.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"packages/@aitos/output/notify.ts","line":15,"fingerprint":"javascript.lang.best-practice.javascript-alert:packages/@aitos/output/notify.ts:15"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"packages/@aitos/output/notify.ts","line":34,"fingerprint":"javascript.lang.best-practice.javascript-confirm:packages/@aitos/output/notify.ts:34"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-prompt","severity":"medium","message":"found prompt() call; should this be in production code?","path":"packages/@aitos/output/notify.ts","line":53,"fingerprint":"javascript.lang.best-practice.javascript-prompt:packages/@aitos/output/notify.ts:53"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/@aitos/transfer/network.ts","line":124,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/@aitos/transfer/network.ts:124"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/@aitos/transfer/network.ts","line":141,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/@aitos/transfer/network.ts:141"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/@aitos/transfer/network.ts","line":142,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/@aitos/transfer/network.ts:142"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/@aitos/transfer/network.ts","line":152,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/@aitos/transfer/network.ts:152"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/@aitos/core/src/runtime.ts","line":489,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/@aitos/core/src/runtime.ts:489"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/@aitos/core/src/runtime.ts","line":489,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/@aitos/core/src/runtime.ts:489"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":7360.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":6.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":231.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":157.0,"escapes_per_kloc":21.332},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: packages/@aitos/3d/tsconfig.json","ref":"packages/@aitos/3d/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}