{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:05.199934Z","repo":{"ref":{"host":"github.com","owner":"isohuntto","name":"openbay"},"default_branch":"master","clone_url":"https://github.com/isohuntto/openbay.git","html_url":"https://github.com/isohuntto/openbay","description":null,"stars":3482,"forks":867,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":15491,"primary_language":"PHP","license_spdx":"NOASSERTION","created_at":"2014-12-19T14:45:37Z","pushed_at":"2019-09-09T00:58:24Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-12-17T07:08:17Z","owner_type":"User","release_assets":[]}},"commit_sha":"53bddc618d6e2bd6f266d2a58b5c5e37de4a692f","profile":{"lines_by_language":{"PHP":9678,"JavaScript":129},"files_by_category":{"source":180,"binary":79,"test":62,"config":41,"other":23,"docs":5},"source_lines":8413,"test_lines":1394},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.42,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":60.2,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":94.5,"duplication":26.2,"lint":81.8,"testing":38.3,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.17, no CI test run detected; 2% of function code in complex or long functions; 22% duplicated lines. Weakest area: duplication."},"security":{"score":69.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":90.5,"sast":76.7,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 4 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":6.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":9896.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2015-02":{"loc":9896,"attributed_loc":0},"2015-03":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":2.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":104.0,"pre_ai_era_burst_loc":0.0,"measured_loc":104.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":14.0,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":9792.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["a001b32b236827dad8cca61227ca8d0b6e7a5d36"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":8413.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":3.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"tests/codeception/common/fixtures/data/init_login.php","line":6,"fingerprint":"tests/codeception/common/fixtures/data/init_login.php:generic-api-key:6"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"tests/codeception/common/unit/fixtures/data/models/user.php","line":6,"fingerprint":"tests/codeception/common/unit/fixtures/data/models/user.php:generic-api-key:6"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"tests/codeception/frontend/unit/fixtures/data/models/user.php","line":6,"fingerprint":"tests/codeception/frontend/unit/fixtures/data/models/user.php:generic-api-key:6"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":14.0,"findings_high":4.0,"findings_medium":9.0,"findings_low":1.0,"weighted_findings":6.362,"scanned_lines":8413.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"frontend/modules/comment/components/Utils.php","line":11,"fingerprint":"php.lang.security.weak-crypto:frontend/modules/comment/components/Utils.php:11"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"frontend/modules/complain/components/Utils.php","line":11,"fingerprint":"php.lang.security.weak-crypto:frontend/modules/complain/components/Utils.php:11"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"frontend/modules/rating/components/Utils.php","line":11,"fingerprint":"php.lang.security.weak-crypto:frontend/modules/rating/components/Utils.php:11"},{"rule_id":"opengrep/php.lang.security.mcrypt-use","severity":"high","message":"Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. [confidence low]","path":"init","line":190,"fingerprint":"php.lang.security.mcrypt-use:init:190"},{"rule_id":"opengrep/php.symfony.security.audit.symfony-non-literal-redirect","severity":"medium","message":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. [confidence low]","path":"frontend/modules/search/controllers/DefaultController.php","line":34,"fingerprint":"php.symfony.security.audit.symfony-non-literal-redirect:frontend/modules/search/controllers/DefaultController.php:34"},{"rule_id":"opengrep/php.symfony.security.audit.symfony-non-literal-redirect","severity":"medium","message":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. [confidence low]","path":"frontend/modules/search/controllers/DefaultController.php","line":83,"fingerprint":"php.symfony.security.audit.symfony-non-literal-redirect:frontend/modules/search/controllers/DefaultController.php:83"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"frontend/modules/torrent/assets/src/js/rating.js","line":11,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:frontend/modules/torrent/assets/src/js/rating.js:11"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"frontend/modules/torrent/assets/src/js/rating.js","line":11,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:frontend/modules/torrent/assets/src/js/rating.js:11"},{"rule_id":"opengrep/php.symfony.security.audit.symfony-non-literal-redirect","severity":"medium","message":"The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. [confidence low]","path":"frontend/modules/torrent/controllers/DefaultController.php","line":73,"fingerprint":"php.symfony.security.audit.symfony-non-literal-redirect:frontend/modules/torrent/controllers/DefaultController.php:73"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:frontend/themes/newopb/assets/js/ui.js:29"},{"rule_id":"opengrep/javascript.lang.security.detect-eval-with-expression","severity":"medium","message":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. [confidence medium]","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.lang.security.detect-eval-with-expression:frontend/themes/newopb/assets/js/ui.js:29"},{"rule_id":"opengrep/javascript.lang.security.detect-eval-with-expression","severity":"medium","message":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. [confidence medium]","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.lang.security.detect-eval-with-expression:frontend/themes/newopb/assets/js/ui.js:29"},{"rule_id":"opengrep/javascript.lang.security.detect-eval-with-expression","severity":"medium","message":"Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. [confidence medium]","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.lang.security.detect-eval-with-expression:frontend/themes/newopb/assets/js/ui.js:29"},{"rule_id":"opengrep/javascript.browser.security.js-open-redirect-from-function","severity":"low","message":"The application accepts potentially user-controlled input `e` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before al [confidence low]","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.browser.security.js-open-redirect-from-function:frontend/themes/newopb/assets/js/ui.js:29"}],"evidence":[],"data":{"rulesets":["php","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"composer.json has no lockfile alongside it (unpinned dependencies)","ref":"composer.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":345.0,"function_nloc":2915.0,"mean_ccn":2.01,"p90_ccn":4.0,"complex_functions":1.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0189},"findings":[],"evidence":[{"kind":"complex-function","description":"DefaultController::actionIndex in frontend/modules/search/controllers/DefaultController.php: complexity 16, 55 lines","ref":"frontend/modules/search/controllers/DefaultController.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/frontend/modules/search/controllers/DefaultController.php#L32","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5131.0,"duplicated_lines":1146.0,"duplicated_share":0.2233,"files":180.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: backend/assets/AppAsset.php:13 and frontend/assets/AppAsset.php:13","ref":"backend/assets/AppAsset.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/backend/assets/AppAsset.php#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/config/main.php:16 and frontend/config/main.php:63","ref":"backend/config/main.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/backend/config/main.php#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/controllers/SiteController.php:30 and frontend/controllers/SiteController.php:39","ref":"backend/controllers/SiteController.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/backend/controllers/SiteController.php#L30","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/views/layouts/main.php:1 and frontend/views/layouts/main.php:1","ref":"backend/views/layouts/main.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/backend/views/layouts/main.php#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/views/site/error.php:1 and frontend/views/site/error.php:1","ref":"backend/views/site/error.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/backend/views/site/error.php#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/views/site/index.php:19 and backend/views/site/index.php:29","ref":"backend/views/site/index.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/backend/views/site/index.php#L19","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/views/site/login.php:1 and frontend/views/site/login.php:1","ref":"backend/views/site/login.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/backend/views/site/login.php#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: common/models/torrent/Files.php:33 and common/models/torrent/Scrape.php:39","ref":"common/models/torrent/Files.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/common/models/torrent/Files.php#L33","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: common/modules/torrent_scraper/models/QueueProcessor.php:40 and common/modules/torrent_scraper/models/QueueProcessor.php:141","ref":"common/modules/torrent_scraper/models/QueueProcessor.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/common/modules/torrent_scraper/models/QueueProcessor.php#L40","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: console/config/main.php:1 and environments/prod/console/config/main-local.php:1","ref":"console/config/main.php","url":"https://github.com/isohuntto/openbay/blob/53bddc618d6e2bd6f266d2a58b5c5e37de4a692f/console/config/main.php#L1","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"weighted_findings":6.75,"scanned_lines":8413.0,"category:best-practice":6.0,"category:correctness":3.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"frontend/modules/comment/assets/js/comments.js","line":23,"fingerprint":"javascript.lang.best-practice.javascript-alert:frontend/modules/comment/assets/js/comments.js:23"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"frontend/modules/comment/assets/js/comments.js","line":26,"fingerprint":"javascript.lang.best-practice.javascript-alert:frontend/modules/comment/assets/js/comments.js:26"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"frontend/modules/complain/assets/js/complain.js","line":5,"fingerprint":"javascript.lang.best-practice.javascript-alert:frontend/modules/complain/assets/js/complain.js:5"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"frontend/modules/complain/assets/js/complain.js","line":7,"fingerprint":"javascript.lang.best-practice.javascript-alert:frontend/modules/complain/assets/js/complain.js:7"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"frontend/modules/rating/assets/js/rating.js","line":8,"fingerprint":"javascript.lang.best-practice.javascript-alert:frontend/modules/rating/assets/js/rating.js:8"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"frontend/modules/rating/assets/js/rating.js","line":11,"fingerprint":"javascript.lang.best-practice.javascript-alert:frontend/modules/rating/assets/js/rating.js:11"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`i` is assigned twice; the first assignment is useless","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.lang.correctness.useless-assignment:frontend/themes/newopb/assets/js/ui.js:29"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`e` is assigned twice; the first assignment is useless","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.lang.correctness.useless-assignment:frontend/themes/newopb/assets/js/ui.js:29"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`r` is assigned twice; the first assignment is useless","path":"frontend/themes/newopb/assets/js/ui.js","line":29,"fingerprint":"javascript.lang.correctness.useless-assignment:frontend/themes/newopb/assets/js/ui.js:29"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.3314,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":1394.0,"source_lines":8413.0,"test_ratio":0.1657,"ci_files":0.0,"cochange_share":0.3333,"cochange_commits":3.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":185.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE.md","ref":"LICENSE.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}