{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:05.273122Z","repo":{"ref":{"host":"github.com","owner":"jacob-bd","name":"relay-ai"},"default_branch":"main","clone_url":"https://github.com/jacob-bd/relay-ai.git","html_url":"https://github.com/jacob-bd/relay-ai","description":"Relay any model into any coding agent","stars":215,"forks":27,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":39953,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-06-09T21:13:59Z","pushed_at":"2026-11-12T20:06:52Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-02-14T18:22:29Z","owner_type":"User","release_assets":[]}},"commit_sha":"b2709b5b9128e06d73ebb594928d4a1bb05ad07a","profile":{"lines_by_language":{"TypeScript":116253,"JavaScript":5803},"files_by_category":{"test":317,"source":278,"vendored":50,"docs":38,"config":18,"other":4,"binary":4,"generated":1,"oversized":1},"source_lines":66638,"test_lines":55418},"pillars":{"ai_provenance":{"score":15.3,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.1531,"suspected_share":0.1028,"estimated_share":0.1531,"ai_artifacts":3.0,"flagged_work_units":12.0,"flagged_releases":2.0,"style_index":0.278},"summary":"Explicit AI attribution on 15% of first-party code added; an estimated 15% including velocity signals."},"quality":{"score":77.3,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":37.9,"duplication":76.8,"lint":86.4,"testing":90.0,"docs":100.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.83, CI runs tests; 32% of function code in complex or long functions; 4% duplicated lines. Weakest area: complexity."},"security":{"score":59.4,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":93.6,"sast":68.3,"dependencies":35.0,"ci_actions":62.8,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 44 known vulnerabilities in 10 dependencies; 61 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":40.0,"checked":40.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":405.0,"attributed_commits":104.0,"attributed_commit_share":0.25679012345679014,"effective_loc":157900.0,"attributed_loc":24181.0,"attributed_loc_share":0.15314122862571247,"tools_detected":3.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 77 attributed commits, 14,109 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 17 attributed commits, 5,955 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 10 attributed commits, 4,117 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"23631ddda53d5e23047f6f73ff9d3b03ad5588d7","url":"https://github.com/jacob-bd/relay-ai/commit/23631ddda53d5e23047f6f73ff9d3b03ad5588d7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"64178e76f7b2663e29aa11e80fc9320dd4652f03","url":"https://github.com/jacob-bd/relay-ai/commit/64178e76f7b2663e29aa11e80fc9320dd4652f03","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"be4675ca9735ce19d96ebcedda279caeea01d363","url":"https://github.com/jacob-bd/relay-ai/commit/be4675ca9735ce19d96ebcedda279caeea01d363","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"83ab12a71838a3a4e790e9111e7b0d1732d033f1","url":"https://github.com/jacob-bd/relay-ai/commit/83ab12a71838a3a4e790e9111e7b0d1732d033f1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"caa79482b1e65fb6ef7afc01fc8efdd3c2664520","url":"https://github.com/jacob-bd/relay-ai/commit/caa79482b1e65fb6ef7afc01fc8efdd3c2664520","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ccc6fcac3afc46bb91612476955b621ce666b75c","url":"https://github.com/jacob-bd/relay-ai/commit/ccc6fcac3afc46bb91612476955b621ce666b75c","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"5621d7ecb3176b5198b4109141bc058aae19c03f","url":"https://github.com/jacob-bd/relay-ai/commit/5621d7ecb3176b5198b4109141bc058aae19c03f","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"35e439bb77b69c3545b4b115ec180f65720234ab","url":"https://github.com/jacob-bd/relay-ai/commit/35e439bb77b69c3545b4b115ec180f65720234ab","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"9d2d5da8f02f1660454d0401acb62070868582c6","url":"https://github.com/jacob-bd/relay-ai/commit/9d2d5da8f02f1660454d0401acb62070868582c6","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"82e5c3f0737d79116df45288bbbc0a4f8ad88fd0","url":"https://github.com/jacob-bd/relay-ai/commit/82e5c3f0737d79116df45288bbbc0a4f8ad88fd0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3bfb1060c4ae453c939142bdecf0ab62019e9c8d","url":"https://github.com/jacob-bd/relay-ai/commit/3bfb1060c4ae453c939142bdecf0ab62019e9c8d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b8f12a6f99125b60399a19263f4798ad2528c791","url":"https://github.com/jacob-bd/relay-ai/commit/b8f12a6f99125b60399a19263f4798ad2528c791","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6aea36dad076e21074791a172e48da587ea59cb6","url":"https://github.com/jacob-bd/relay-ai/commit/6aea36dad076e21074791a172e48da587ea59cb6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6df5230455732d9ed21d60ff230fee3c8e45755e","url":"https://github.com/jacob-bd/relay-ai/commit/6df5230455732d9ed21d60ff230fee3c8e45755e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1b72eb695842f04a97b3439d62c8c145c7d66d1f","url":"https://github.com/jacob-bd/relay-ai/commit/1b72eb695842f04a97b3439d62c8c145c7d66d1f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"68dc5141a3240a1dbbac9f4ce5a903d03177a3a0","url":"https://github.com/jacob-bd/relay-ai/commit/68dc5141a3240a1dbbac9f4ce5a903d03177a3a0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b2b1db9bd22518794b181c8d3bbf1085eac78adc","url":"https://github.com/jacob-bd/relay-ai/commit/b2b1db9bd22518794b181c8d3bbf1085eac78adc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d7fce6c7408cadc3767b8db8eead20507094a1e4","url":"https://github.com/jacob-bd/relay-ai/commit/d7fce6c7408cadc3767b8db8eead20507094a1e4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d15c66b04c62ad4a05ca40963e9462d65e3ba324","url":"https://github.com/jacob-bd/relay-ai/commit/d15c66b04c62ad4a05ca40963e9462d65e3ba324","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d205524bf2f068770b9b60dabeb607003684d99f","url":"https://github.com/jacob-bd/relay-ai/commit/d205524bf2f068770b9b60dabeb607003684d99f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2392de02300f09d6a850bf29f442340887fb42c2","url":"https://github.com/jacob-bd/relay-ai/commit/2392de02300f09d6a850bf29f442340887fb42c2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1bc6072e9e4632dd7ebb9f191bd54361159087d6","url":"https://github.com/jacob-bd/relay-ai/commit/1bc6072e9e4632dd7ebb9f191bd54361159087d6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b7fc3522f3c402bbacb6e33c204d8f2f4a1c9bfc","url":"https://github.com/jacob-bd/relay-ai/commit/b7fc3522f3c402bbacb6e33c204d8f2f4a1c9bfc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ec83f1313d70ed96bed3fd4695cea9182b54aebb","url":"https://github.com/jacob-bd/relay-ai/commit/ec83f1313d70ed96bed3fd4695cea9182b54aebb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7fb612127cfd9851b52c083bd373d1aad6618bbf","url":"https://github.com/jacob-bd/relay-ai/commit/7fb612127cfd9851b52c083bd373d1aad6618bbf","weight":0.9}],"data":{"attributed_loc_by_commit":{"8048224dff79d6a4b2b09d368bab9afd00ffdea3":239,"75be10798254a3acf3d2dc16e0301d9163d233d2":0,"c10aa3ece37b97b6567fd5aaa68c2d91f950b7c0":0,"2e09628997ab409c26c205205a7af3e0058c5570":29,"7b5ff019138b5f38f6f584d1a7a7df17d91cd56c":21,"e7b168c017cb127587b0927d303be1d2a14734c6":0,"c43394eec162251babef20cb8d185506a42e7dad":0,"4a3c32e261e2f1eb81d114fe81f2afe96b544db8":16,"f46cc561b3fc79a2d18536a071bcb25c8ccedbbb":1646,"89c88a38e03a4634e65a7d7d3920fabf144e48b5":1811,"b62343731beddf628084e8c175dd6b424fa117a3":5,"447e460e0892f3ad7b981037c4ed1838168a4a14":0,"ae30c8ae67073f827978d479d6f5789403830db1":54,"f3c881dd82d53bf210e9e7b1afb1002a7dd93c86":0,"dce92eee632eba711fe5ad2a72c69591eca9e301":53,"a78c82cc5e5434cb554e497a99ce2d68d62eea72":1008,"719cf00f7b05dda1cc56635e2a6b617b36db63fd":321,"20e736a581d6355ace98511e0489b1275ac1ad76":46,"30e6045b2c4796135439cb1c18aef3f8951854ee":17,"05cff15abdd0f90bb22587500511ae546e71b290":2,"73a8358ade74c98b176d50de20eab3ade3b1d59d":47,"56d96f65ff7f04ec260887030841d706c746b364":79,"9a0405e549ad2214364280dd31861109b673894a":135,"b151cdcc1a4b8c772c7adfa4b8844e9d13afb16c":139,"fdbab568835b9dcd46e5e4dc30cb6e02e6096311":0,"41e25b2ef177fc1b45469ced353be02b31da85a6":808,"139e3bcdc731e30ddf668baccf7c1f14a7ba0d47":886,"1ec83cf309f527d987be64c3e6eacdbe2f465214":0,"e448e07f595858bad01475df23803fa4fc1bfa28":25,"881cac4fe905fb2d85ada5e0f447c3eaed3288a6":140,"93a7be319f2bf4d00b6adca9434efc49e9dd7b9c":325,"b4de2920b4149204a9a23695284bf30ce9b8d1c8":5,"2323afbf90a648eb517513881c94203d06cd6f9b":165,"e9878f3b4b9dc02bb77ddcd0450228d798309599":461,"b6896dbbd13eba0efeebcd2a699c64a5ffa0cec7":265,"d270a9bdc1876988a65a0c02f121422232c8cab3":0,"3da9b884295b45eb0151e4dc587777584ceb77bc":120,"10e2fda17c484667b632f6ef4957ca8e882dbe77":0,"9390bc7e9c373dc4790f947d6ecaa7b18894d7a1":54,"b93f5c84f864e1191971df1ad898d6c71e4586f2":30,"5c328d48d9be2ce92f2921ff11d84f7776db82e1":0,"adc65d7b38a90c59d1e10fd426cdf1a4489f2703":27,"daa949a89c9806917e6915839461c80e4142b6ec":0,"2744cbb6f704a5b2e6ce39c7b4baa651f3d7249e":0,"36ce48420d836d1687df0135772997e6aaedbcef":276,"73e1cf5966b9a4c8e963fdb838630dc0007f9e52":344,"63176b2d42bdcaa9a249d887418d8f0803dec2eb":0,"bb54c54d0ed967d264799adc01be733f0ec3b03f":61,"de7d0a373a7b7d07e5d576ae2707aadad6c5b624":16,"4d3f1702ff379f04d6465e762395aeb45f9002d8":91,"d7424cacf03d18d9517ebc3175b8a5b77322e577":45,"484b144801505e5f11d0ed6b02805d8f5c842c6c":98,"4b7a7047bceb5810ed4f2dad13ff75763d02dd45":193,"964a07b8d4ae7b49a0df6adfc06c8fe872949266":104,"0a8272a90cb4ff3e13e14ce2d97a1860b2181d39":0,"34e98dea63040ab421969bcda31e013558ca16a7":0,"d20acbacc8c9f327f093ad2b2168a7687c3f1b60":141,"d6284590020e4988125a5d145cf61060cf65eb97":0,"02f5642907a2e69f840fc782bf1a9b9e6781baf7":122,"1e51a1ab1f2c002fcad11c4e780bd5ddae56ad3c":189,"cfaad90b3618dcdc15e6d4c65220bf75861856a2":2364,"41d17243a37040b82386820dccc6dc1f724b8655":653,"457628c2a8544fca69fc86d58495625f3b7775bd":32,"d7aab4096d0ac8a4cf5c3f8ffefef35bda27caaf":41,"33988eebb50eb39125be8f62c6f54ed247d16537":156,"4e8ee1cbd691bb5dffad68ce2496a9ca34cc35cd":164,"819372bebf64f66b114a2c5e813321594e61311d":43,"74928eaef0bf025f0cf15445a9ac534d3316b16c":45,"2a61cbc121d7d9740da68967ef12d2d7e1fc9077":110,"56759b9ff8d78fcc104eecbe259f7e775f178187":47,"3b884d8bb22bf891f3cd3594bb50160bd1e20f4f":21,"8adb861caeee94be8ab7fe71618294b48b3b009b":105,"a12b76e6e5d10fdc8e385762203b9a3f0b501c1b":114,"b6e42d7f5284ec89a9833fa93470cf2fbb67deb5":41,"53a59bd6df35e713137f36d4ab7db7483aadd3fa":298,"42f69a962249c286dbc540890b6d323aa0a49783":9,"363ff8a3a95ca9e8708af4df562c20126d62fb61":23,"390269f4c43dc9f9244ad5da85c5122ede4891fc":125,"1bdeeeb2ec190d1d177552b4530c4812d8ac9b05":121,"7fb612127cfd9851b52c083bd373d1aad6618bbf":34,"ec83f1313d70ed96bed3fd4695cea9182b54aebb":105,"b7fc3522f3c402bbacb6e33c204d8f2f4a1c9bfc":51,"1bc6072e9e4632dd7ebb9f191bd54361159087d6":138,"2392de02300f09d6a850bf29f442340887fb42c2":640,"d205524bf2f068770b9b60dabeb607003684d99f":963,"d15c66b04c62ad4a05ca40963e9462d65e3ba324":1664,"d7fce6c7408cadc3767b8db8eead20507094a1e4":388,"b2b1db9bd22518794b181c8d3bbf1085eac78adc":142,"68dc5141a3240a1dbbac9f4ce5a903d03177a3a0":929,"1b72eb695842f04a97b3439d62c8c145c7d66d1f":0,"6df5230455732d9ed21d60ff230fee3c8e45755e":17,"6aea36dad076e21074791a172e48da587ea59cb6":21,"b8f12a6f99125b60399a19263f4798ad2528c791":865,"3bfb1060c4ae453c939142bdecf0ab62019e9c8d":2,"82e5c3f0737d79116df45288bbbc0a4f8ad88fd0":96,"9d2d5da8f02f1660454d0401acb62070868582c6":4,"35e439bb77b69c3545b4b115ec180f65720234ab":518,"5621d7ecb3176b5198b4109141bc058aae19c03f":1588,"ccc6fcac3afc46bb91612476955b621ce666b75c":540,"caa79482b1e65fb6ef7afc01fc8efdd3c2664520":222,"83ab12a71838a3a4e790e9111e7b0d1732d033f1":35,"be4675ca9735ce19d96ebcedda279caeea01d363":36,"64178e76f7b2663e29aa11e80fc9320dd4652f03":0,"23631ddda53d5e23047f6f73ff9d3b03ad5588d7":12},"tools":{"claude-code":{"name":"Claude Code","commits":77,"loc":14109,"first_seen":1781837063,"last_seen":1794384632},"cursor":{"name":"Cursor agent","commits":17,"loc":5955,"first_seen":1783725285,"last_seen":1794089087},"openai-codex":{"name":"OpenAI Codex","commits":10,"loc":4117,"first_seen":1783924075,"last_seen":1792889533}},"monthly":{"2026-06":{"loc":55381,"attributed_loc":289},"2026-07":{"loc":38848,"attributed_loc":5240},"2026-08":{"loc":13646,"attributed_loc":2323},"2026-09":{"loc":11543,"attributed_loc":1747},"2026-10":{"loc":11967,"attributed_loc":608},"2026-11":{"loc":26515,"attributed_loc":13974}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":3.0,"workflow_agents":0.0,"tools_configured":3.0,"earliest_adoption":1781814019.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":".cursor/rules/post-change-build-link.mdc (cursor configuration)","ref":".cursor/rules/post-change-build-link.mdc","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/.cursor/rules/post-change-build-link.mdc","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1781817518},{"tool":"generic-agent","path":"AGENTS.md","added_at":1781817518},{"tool":"cursor","path":".cursor/rules/post-change-build-link.mdc","added_at":1781814019}],"workflows":[],"tools":["claude-code","cursor","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":162.0,"flagged_units":12.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":77957.0,"flagged_loc":22377.0,"flagged_loc_share":0.28704285695960596,"max_loc_per_hour":1564.699393270822,"median_loc_per_hour":170.8201174764449,"pr_timed_units":20.0,"excluded_import_loc":79943.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,364 lines of first-party code in ~1.5h (1,565 lines/hour, 1 commit session)","ref":"cfaad90b3618dcdc15e6d4c65220bf75861856a2","url":"https://github.com/jacob-bd/relay-ai/commit/cfaad90b3618dcdc15e6d4c65220bf75861856a2","weight":0.4694098179812466},{"kind":"velocity-burst","description":"1,588 lines of first-party code in ~1.1h (1,383 lines/hour, 1 commit session)","ref":"5621d7ecb3176b5198b4109141bc058aae19c03f","url":"https://github.com/jacob-bd/relay-ai/commit/5621d7ecb3176b5198b4109141bc058aae19c03f","weight":0.41486211901306236},{"kind":"velocity-burst","description":"1,072 lines of first-party code in ~0.9h (1,134 lines/hour, 3 commit session)","ref":"3369a1057666330d7d3d0dc3c3532e9972efa52a","url":"https://github.com/jacob-bd/relay-ai/commit/3369a1057666330d7d3d0dc3c3532e9972efa52a","weight":0.3403174603174603},{"kind":"velocity-burst","description":"1,123 lines of first-party code in ~1.2h (970 lines/hour, 3 commit session)","ref":"0f73bc258362e68e1fbd7bd2c48a85894a1aa777","url":"https://github.com/jacob-bd/relay-ai/commit/0f73bc258362e68e1fbd7bd2c48a85894a1aa777","weight":0.29098848368522073},{"kind":"velocity-burst","description":"3,791 lines of first-party code in ~4.0h (948 lines/hour, 1 commit session)","ref":"bd61879a41e5fb08fad84bf527b2194de5051fe2","url":"https://github.com/jacob-bd/relay-ai/commit/bd61879a41e5fb08fad84bf527b2194de5051fe2","weight":0.284325},{"kind":"velocity-burst","description":"1,682 lines of first-party code in ~1.9h (865 lines/hour, 9 commit session)","ref":"7eaefb84b1001ab12de37c297366f91c01abf312","url":"https://github.com/jacob-bd/relay-ai/commit/7eaefb84b1001ab12de37c297366f91c01abf312","weight":0.2594344473007712},{"kind":"velocity-burst","description":"1,587 lines of first-party code in ~2.1h (746 lines/hour, 4 commit session)","ref":"71e7db262cdf98fcfa8d82d68cc8fe3ff413e47d","url":"https://github.com/jacob-bd/relay-ai/commit/71e7db262cdf98fcfa8d82d68cc8fe3ff413e47d","weight":0.2237837837837838},{"kind":"velocity-burst","description":"2,194 lines of first-party code in ~3.0h (737 lines/hour, 3 commit session)","ref":"b2b1db9bd22518794b181c8d3bbf1085eac78adc","url":"https://github.com/jacob-bd/relay-ai/commit/b2b1db9bd22518794b181c8d3bbf1085eac78adc","weight":0.22109918820565458},{"kind":"velocity-burst","description":"1,080 lines of first-party code in ~1.5h (720 lines/hour, 3 commit session)","ref":"a124c1338b6ecb309342765031a6608a67bc46b4","url":"https://github.com/jacob-bd/relay-ai/commit/a124c1338b6ecb309342765031a6608a67bc46b4","weight":0.21608002964060766},{"kind":"velocity-burst","description":"1,120 lines of first-party code in ~1.6h (703 lines/hour, 4 commit session)","ref":"fd6c625b667f9826d3c29883f86544fd91798edd","url":"https://github.com/jacob-bd/relay-ai/commit/fd6c625b667f9826d3c29883f86544fd91798edd","weight":0.21091543156059286},{"kind":"velocity-burst","description":"2,653 lines of first-party code in ~3.8h (691 lines/hour, 1 commit session)","ref":"563476eb6e03a22b9561d1bb82a1ac4b1a170019","url":"https://github.com/jacob-bd/relay-ai/commit/563476eb6e03a22b9561d1bb82a1ac4b1a170019","weight":0.20732561505065122},{"kind":"velocity-burst","description":"2,123 lines of first-party code in ~4.0h (531 lines/hour, 1 commit session)","ref":"22df010321d0983f615a7a19a3b853453c6a96df","url":"https://github.com/jacob-bd/relay-ai/commit/22df010321d0983f615a7a19a3b853453c6a96df","weight":0.159225}],"data":{"flagged_loc_by_commit":{"b2c46948dd10055a72b2008f27166906fcbdb8d5":1338,"6157d21f9f13d431074621a0818c013777fd2d8b":191,"2d72de252a1ec122c66c98b9d42f013ffd25349d":53,"71e7db262cdf98fcfa8d82d68cc8fe3ff413e47d":5,"bd61879a41e5fb08fad84bf527b2194de5051fe2":3791,"22df010321d0983f615a7a19a3b853453c6a96df":2123,"cf448740ba96c11e1fb5e0fc183f3123049937c5":80,"29b3831da06879a730d82b44f413df8fc7ebdd6f":16,"7891e4c288daf07aec0df640b834fbfc0d1d46df":294,"1a3ccb684f890635827464258d0fc8c06a7b1a90":561,"04beb22c02a7779e8b6b0c9428b311de2d5ac13c":174,"bde59cfa14953d37c16b30760fcce649ffd2d87f":151,"e343382accfd39dc797639038ab8d48c113b7b0c":65,"f9f8f9dd50255d7fbb4b8e8ceb265f8d59b1ced8":151,"7eaefb84b1001ab12de37c297366f91c01abf312":190,"5cc9681844fa1412a53eba6ad02ebf2951337a88":697,"935406a33e20e0eca34f24c86cf8fcd1552f0e26":27,"a124c1338b6ecb309342765031a6608a67bc46b4":356,"e217d2f003fb03acee5bf9372e4d3dce7746774f":61,"3369a1057666330d7d3d0dc3c3532e9972efa52a":674,"7358b5c3e6a86a871a85d2e287a2be6ceb221f32":337,"935c956856ea3b204e340c6184423e33c5c0a215":795,"24787602ebcf8148c4dfec44af9aae5b8626fa8c":219,"0f73bc258362e68e1fbd7bd2c48a85894a1aa777":109,"1db3e1e5f6a539450dcbca09a228a0ad9c070ada":103,"338a9390ced1c8fa69866364ba60dbd7f3381253":383,"f71842d02265142603435851afe5a484d764d832":575,"fd6c625b667f9826d3c29883f86544fd91798edd":59,"563476eb6e03a22b9561d1bb82a1ac4b1a170019":2653,"cfaad90b3618dcdc15e6d4c65220bf75861856a2":2364,"d15c66b04c62ad4a05ca40963e9462d65e3ba324":1664,"d7fce6c7408cadc3767b8db8eead20507094a1e4":388,"b2b1db9bd22518794b181c8d3bbf1085eac78adc":142,"5621d7ecb3176b5198b4109141bc058aae19c03f":1588},"excluded_import_commits":["030c635ff53d93415d8aab30851bc5f3b57b84aa","13ddff8c2fa0815872ef941106bf8a2589fe9197","154bed6b159fc5f7dae3159cb9bca5578b11ba0c","37f4697e528adf7ed1cfdd658883a090616ee6eb"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":88.0,"flagged_releases":2.0,"max_loc_per_day":33189.0},"findings":[],"evidence":[{"kind":"release-burst","description":"v0.16.1 → v0.17.0: 5,195 lines in 1.01 days (5,132.9 lines/day)","ref":"v0.16.1...v0.17.0","url":"https://github.com/jacob-bd/relay-ai/compare/v0.16.1...v0.17.0","weight":0.4},{"kind":"release-burst","description":"v0.19.0 → v0.20.0: 10,306 lines in 1.92 days (5,372.8 lines/day)","ref":"v0.19.0...v0.20.0","url":"https://github.com/jacob-bd/relay-ai/compare/v0.19.0...v0.20.0","weight":0.4}],"data":{"releases":[{"from":"v0.2.8","to":"v0.3.2","loc":2050,"days":1.79,"loc_per_day":1142.3,"flagged":false},{"from":"v0.3.2","to":"v0.3.3","loc":10,"days":0.12,"loc_per_day":83.7,"flagged":false},{"from":"v0.3.3","to":"v0.3.4","loc":29,"days":0.82,"loc_per_day":35.2,"flagged":false},{"from":"v0.3.4","to":"v0.3.5","loc":21,"days":3.12,"loc_per_day":6.7,"flagged":false},{"from":"v0.3.5","to":"v0.4.0","loc":0,"days":13.93,"loc_per_day":0.0,"flagged":false},{"from":"v0.4.0","to":"v0.4.1","loc":579,"days":0.89,"loc_per_day":653.3,"flagged":false},{"from":"v0.4.1","to":"v0.4.3","loc":16,"days":0.29,"loc_per_day":54.9,"flagged":false},{"from":"v0.4.3","to":"v0.4.4","loc":476,"days":1.69,"loc_per_day":282.0,"flagged":false},{"from":"v0.4.4","to":"v0.4.5","loc":901,"days":2.26,"loc_per_day":398.3,"flagged":false},{"from":"v0.4.5","to":"v0.4.6","loc":232,"days":0.77,"loc_per_day":301.4,"flagged":false},{"from":"v0.4.6","to":"v0.4.7","loc":3516,"days":0.33,"loc_per_day":10718.8,"flagged":false},{"from":"v0.4.7","to":"v0.4.8","loc":53,"days":1.65,"loc_per_day":32.1,"flagged":false},{"from":"v0.4.8","to":"v0.4.9","loc":1374,"days":0.84,"loc_per_day":1641.3,"flagged":false},{"from":"v0.4.9","to":"v0.5.0","loc":493,"days":0.16,"loc_per_day":3168.3,"flagged":false},{"from":"v0.5.0","to":"v0.6.0","loc":1008,"days":1.26,"loc_per_day":798.0,"flagged":false},{"from":"v0.6.0","to":"v0.6.1","loc":321,"days":0.06,"loc_per_day":5588.2,"flagged":false},{"from":"v0.6.1","to":"v0.6.2","loc":750,"days":1.84,"loc_per_day":407.3,"flagged":false},{"from":"v0.6.2","to":"v0.6.3","loc":1483,"days":0.8,"loc_per_day":1848.8,"flagged":false},{"from":"v0.6.3","to":"v0.7.0","loc":975,"days":0.22,"loc_per_day":4491.1,"flagged":false},{"from":"v0.7.0","to":"v0.7.1","loc":912,"days":1.34,"loc_per_day":680.7,"flagged":false},{"from":"v0.7.1","to":"v0.7.2","loc":528,"days":0.53,"loc_per_day":991.0,"flagged":false},{"from":"v0.7.2","to":"v0.7.3","loc":442,"days":1.22,"loc_per_day":361.1,"flagged":false},{"from":"v0.7.3","to":"v0.7.4","loc":21,"days":1.86,"loc_per_day":11.3,"flagged":false},{"from":"v0.7.4","to":"v0.7.5","loc":757,"days":0.21,"loc_per_day":3577.9,"flagged":false},{"from":"v0.7.5","to":"v0.7.6","loc":1978,"days":0.93,"loc_per_day":2126.9,"flagged":false},{"from":"v0.7.6","to":"v0.8.0","loc":1747,"days":7.98,"loc_per_day":218.9,"flagged":false},{"from":"v0.8.0","to":"v0.9.0","loc":3792,"days":5.57,"loc_per_day":680.2,"flagged":false},{"from":"v0.9.0","to":"v0.9.1","loc":139,"days":1.3,"loc_per_day":106.7,"flagged":false},{"from":"v0.9.1","to":"v0.9.2","loc":1694,"days":0.15,"loc_per_day":11561.9,"flagged":false},{"from":"v0.9.2","to":"v0.9.3","loc":3830,"days":0.89,"loc_per_day":4288.6,"flagged":false},{"from":"v0.9.3","to":"v0.9.4","loc":21,"days":0.87,"loc_per_day":24.0,"flagged":false},{"from":"v0.9.4","to":"v0.9.5","loc":904,"days":1.92,"loc_per_day":471.5,"flagged":false},{"from":"v0.9.5","to":"v0.9.6","loc":1303,"days":3.14,"loc_per_day":415.0,"flagged":false},{"from":"v0.9.6","to":"v0.9.7","loc":216,"days":9.76,"loc_per_day":22.1,"flagged":false},{"from":"v0.9.7","to":"v0.9.8","loc":48,"days":3.49,"loc_per_day":13.8,"flagged":false},{"from":"v0.9.8","to":"v0.10.0","loc":748,"days":4.62,"loc_per_day":162.0,"flagged":false},{"from":"v0.10.0","to":"v0.10.1","loc":5,"days":0.06,"loc_per_day":81.4,"flagged":false},{"from":"v0.10.1","to":"v0.11.0","loc":165,"days":0.09,"loc_per_day":1900.8,"flagged":false},{"from":"v0.11.0","to":"v0.11.1","loc":1521,"days":1.08,"loc_per_day":1403.6,"flagged":false},{"from":"v0.11.1","to":"v0.12.0","loc":966,"days":1.84,"loc_per_day":524.5,"flagged":false},{"from":"v0.12.0","to":"v0.12.1","loc":30,"days":1.05,"loc_per_day":28.5,"flagged":false},{"from":"v0.12.1","to":"v0.12.2","loc":27,"days":0.04,"loc_per_day":648.0,"flagged":false},{"from":"v0.12.2","to":"v0.12.3","loc":276,"days":1.92,"loc_per_day":143.9,"flagged":false},{"from":"v0.12.3","to":"v0.12.4","loc":146,"days":0.29,"loc_per_day":500.9,"flagged":false},{"from":"v0.12.4","to":"v0.12.5","loc":1615,"days":2.81,"loc_per_day":574.7,"flagged":false},{"from":"v0.12.5","to":"v0.12.6","loc":446,"days":2.87,"loc_per_day":155.6,"flagged":false},{"from":"v0.12.6","to":"v0.12.8","loc":302,"days":0.31,"loc_per_day":962.5,"flagged":false},{"from":"v0.12.8","to":"v0.12.9","loc":167,"days":0.54,"loc_per_day":306.5,"flagged":false},{"from":"v0.12.9","to":"v0.12.10","loc":344,"days":2.04,"loc_per_day":169.0,"flagged":false},{"from":"v0.12.10","to":"v0.12.11","loc":267,"days":1.03,"loc_per_day":258.3,"flagged":false},{"from":"v0.12.11","to":"v0.13.0","loc":9,"days":0.17,"loc_per_day":53.7,"flagged":false},{"from":"v0.13.0","to":"v0.14.0","loc":912,"days":1.08,"loc_per_day":841.7,"flagged":false},{"from":"v0.14.0","to":"v0.15.0","loc":1282,"days":0.77,"loc_per_day":1666.6,"flagged":false},{"from":"v0.15.0","to":"v0.15.1","loc":127,"days":0.17,"loc_per_day":731.4,"flagged":false},{"from":"v0.15.1","to":"v0.15.2","loc":286,"days":1.0,"loc_per_day":286.7,"flagged":false},{"from":"v0.15.2","to":"v0.15.3","loc":394,"days":2.05,"loc_per_day":192.1,"flagged":false},{"from":"v0.15.3","to":"v0.15.4","loc":1460,"days":1.08,"loc_per_day":1355.0,"flagged":false},{"from":"v0.15.4","to":"v0.15.5","loc":346,"days":1.05,"loc_per_day":330.0,"flagged":false},{"from":"v0.15.5","to":"v0.15.6","loc":447,"days":0.73,"loc_per_day":616.3,"flagged":false},{"from":"v0.15.6","to":"v0.15.7","loc":441,"days":2.07,"loc_per_day":213.5,"flagged":false},{"from":"v0.15.7","to":"v0.15.8","loc":47,"days":0.71,"loc_per_day":66.4,"flagged":false},{"from":"v0.15.8","to":"v0.15.9","loc":55,"days":1.25,"loc_per_day":43.9,"flagged":false},{"from":"v0.15.9","to":"v0.15.10","loc":692,"days":1.15,"loc_per_day":600.9,"flagged":false},{"from":"v0.15.10","to":"v0.15.11","loc":153,"days":1.73,"loc_per_day":88.2,"flagged":false},{"from":"v0.15.11","to":"v0.15.12","loc":317,"days":0.09,"loc_per_day":3663.6,"flagged":false},{"from":"v0.15.12","to":"v0.15.13","loc":6,"days":0.04,"loc_per_day":144.0,"flagged":false},{"from":"v0.15.13","to":"v0.15.14","loc":275,"days":1.18,"loc_per_day":233.1,"flagged":false},{"from":"v0.15.14","to":"v0.15.15","loc":1435,"days":5.0,"loc_per_day":287.3,"flagged":false},{"from":"v0.15.15","to":"v0.15.16","loc":63,"days":2.98,"loc_per_day":21.1,"flagged":false},{"from":"v0.15.16","to":"v0.15.17","loc":77,"days":1.9,"loc_per_day":40.5,"flagged":false},{"from":"v0.15.17","to":"v0.15.18","loc":136,"days":5.7,"loc_per_day":23.9,"flagged":false},{"from":"v0.15.18","to":"v0.16.0","loc":1216,"days":3.44,"loc_per_day":353.6,"flagged":false},{"from":"v0.16.0","to":"v0.16.1","loc":35,"days":0.04,"loc_per_day":840.0,"flagged":false},{"from":"v0.16.1","to":"v0.17.0","loc":5195,"days":1.01,"loc_per_day":5132.9,"flagged":true},{"from":"v0.17.0","to":"v0.18.0","loc":2286,"days":3.89,"loc_per_day":587.2,"flagged":false},{"from":"v0.18.0","to":"v0.18.1","loc":74,"days":1.0,"loc_per_day":74.2,"flagged":false},{"from":"v0.18.1","to":"v0.19.0","loc":2653,"days":0.18,"loc_per_day":15077.2,"flagged":false},{"from":"v0.19.0","to":"v0.20.0","loc":10306,"days":1.92,"loc_per_day":5372.8,"flagged":true},{"from":"v0.20.0","to":"v0.21.0","loc":907,"days":0.81,"loc_per_day":1123.8,"flagged":false},{"from":"v0.21.0","to":"v0.21.1","loc":100,"days":1.01,"loc_per_day":98.7,"flagged":false},{"from":"v0.21.1","to":"v0.21.2","loc":518,"days":0.04,"loc_per_day":12432.0,"flagged":false},{"from":"v0.21.2","to":"v0.22.0","loc":1588,"days":0.05,"loc_per_day":33189.0,"flagged":false},{"from":"v0.22.0","to":"v0.22.1","loc":400,"days":0.95,"loc_per_day":420.8,"flagged":false},{"from":"v0.22.1","to":"v0.22.2","loc":197,"days":0.05,"loc_per_day":4122.3,"flagged":false},{"from":"v0.22.2","to":"v0.22.3","loc":540,"days":0.13,"loc_per_day":4318.4,"flagged":false},{"from":"v0.22.3","to":"v0.22.4","loc":222,"days":0.04,"loc_per_day":5328.0,"flagged":false},{"from":"v0.22.4","to":"v0.22.5","loc":71,"days":0.93,"loc_per_day":75.9,"flagged":false},{"from":"v0.22.5","to":"v0.22.6","loc":638,"days":2.84,"loc_per_day":224.6,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":66638.0,"index":0.278,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":33.0,"per_kloc:emoji_in_code":0.495,"files:emoji_in_code":13.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.015,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:assistant_voice","description":"assistant-style phrasing left in code: /** Catalog route id — agy cascade uses this as RequestedModel when present. */","ref":"src/antigravity/types.ts:41","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity/types.ts#L41","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":2.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"tests/core-route-id.test.ts","line":83,"fingerprint":"tests/core-route-id.test.ts:generic-api-key:83"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"tests/trace-log.test.ts","line":41,"fingerprint":"tests/trace-log.test.ts:generic-api-key:41"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":167.0,"findings_high":61.0,"findings_medium":106.0,"findings_low":0.0,"weighted_findings":72.6,"scanned_lines":66638.0,"parse_errors":9.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: isWindows}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]","path":"src/gemini/launch.ts","line":103,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:src/gemini/launch.ts:103"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":496,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:496"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `header.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":496,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:496"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":621,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:621"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":621,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:621"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":722,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:722"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `popover.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":722,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:722"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":803,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:803"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":803,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:803"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1033,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:1033"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `cell.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1033,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:1033"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1089,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:1089"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `cell.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1089,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:1089"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1142,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:1142"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `cell.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1142,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:1142"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1191,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:1191"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `cell.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1191,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:1191"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1359,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:1359"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `slot.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1359,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:1359"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1534,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:1534"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `header.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":1534,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:1534"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2926,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:2926"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2926,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:2926"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2935,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:2935"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2935,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:2935"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2940,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:2940"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2940,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:2940"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2975,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:2975"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `groupHeader.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":2975,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:2975"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3187,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:3187"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3187,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:3187"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3232,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:3232"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3232,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:3232"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3343,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:3343"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3343,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:3343"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3433,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:3433"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3433,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:3433"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3580,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:3580"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3580,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:3580"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3923,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:3923"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `counter.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3923,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:3923"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3941,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:3941"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `counter.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":3941,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:3941"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4017,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:4017"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4017,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:4017"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4495,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:4495"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `cliContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4495,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:4495"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4496,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:4496"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `desktopContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4496,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:4496"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4514,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:4514"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4514,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:4514"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4608,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:4608"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `menu.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4608,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:4608"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4861,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:4861"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":4861,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:4861"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":5133,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:5133"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tbody.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":5133,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:5133"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":5157,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:5157"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":5157,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:5157"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":5362,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/public/app.js:5362"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/public/app.js","line":5362,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/public/app.js:5362"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `rootDir` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/release-metadata.mjs","line":29,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/release-metadata.mjs:29"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `profile` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/antigravity/launch-ide.ts","line":258,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/antigravity/launch-ide.ts:258"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/cli.ts","line":949,"fingerprint":"javascript.lang.security.html-in-template-string:src/cli.ts:949"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/core/pool-model.ts","line":484,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/core/pool-model.ts:484"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/core/usage.ts","line":199,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/core/usage.ts:199"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/gemini-proxy.ts","line":502,"fingerprint":"javascript.lang.security.html-in-template-string:src/gemini-proxy.ts:502"},{"rule_id":"opengrep/javascript.browser.security.raw-html-join","severity":"medium","message":"User controlled data in a HTML string may result in XSS [confidence low]","path":"src/pool/command.ts","line":19,"fingerprint":"javascript.browser.security.raw-html-join:src/pool/command.ts:19"},{"rule_id":"opengrep/javascript.express.security.cors-misconfiguration","severity":"medium","message":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings. [confidence medium]","path":"src/ui/api.ts","line":147,"fingerprint":"javascript.express.security.cors-misconfiguration:src/ui/api.ts:147"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/api.ts","line":1520,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/api.ts:1520"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":179,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:179"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":180,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:180"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":417,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:417"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":420,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:420"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":422,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:422"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":501,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:501"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":597,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:597"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":613,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:613"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":619,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:619"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":731,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:731"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":803,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:803"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":832,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:832"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":848,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:848"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1009,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1009"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1017,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1017"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1023,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1023"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1115,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1115"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1117,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1117"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1125,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1125"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1126,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1126"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1132,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1132"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1133,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1133"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1206,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1206"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1209,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1209"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1212,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1212"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1531,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1531"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":1534,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:1534"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":2926,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:2926"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":2958,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:2958"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":2975,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:2975"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3066,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3066"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3069,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3069"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3071,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3071"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3143,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3143"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3145,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3145"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3145,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3145"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3146,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3146"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3146,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3146"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3156,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3156"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3156,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3156"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3165,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3165"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3167,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3167"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3180,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3180"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3232,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3232"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3247,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3247"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3254,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3254"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3258,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3258"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3260,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3260"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3278,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3278"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3279,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3279"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3300,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3300"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3320,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3320"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3323,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3323"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3325,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3325"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3343,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3343"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3381,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3381"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3386,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3386"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3389,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3389"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3392,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3392"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3392,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3392"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3402,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3402"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3418,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3418"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3423,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3423"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3431,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3431"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3458,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3458"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3923,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3923"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":3941,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:3941"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4017,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4017"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4339,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4339"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4341,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4341"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4347,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4347"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4407,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4407"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4467,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4467"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4518,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4518"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4876,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4876"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4891,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4891"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4897,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4897"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4899,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4899"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4911,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4911"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4912,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4912"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":4947,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:4947"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5013,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5013"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5018,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5018"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5029,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5029"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5045,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5045"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5068,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5068"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5111,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5111"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5121,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5121"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5255,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5255"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5320,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5320"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5328,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5328"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5329,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5329"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5336,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5336"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/app.js","line":5379,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/app.js:5379"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/provider-logo.js","line":68,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/provider-logo.js:68"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/provider-model-browser.js","line":78,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/provider-model-browser.js:78"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/public/provider-model-browser.js","line":81,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/public/provider-model-browser.js:81"}],"evidence":[],"data":{"rulesets":["typescript","javascript","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":10.0,"vulnerabilities":44.0,"vulns_critical":0.0,"vulns_high":17.0,"vulns_medium":19.0,"vulns_low":8.0,"vulns_unknown":0.0,"penalty":63.0},"findings":[{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.17 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.17 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-5x38-2vff-x55p","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-5x38-2vff-x55p","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-5x38-2vff-x55p"},{"rule_id":"osv/GHSA-6qrw-m8cv-hcxf","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-6qrw-m8cv-hcxf","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-6qrw-m8cv-hcxf"},{"rule_id":"osv/GHSA-7wch-p9px-956x","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-7wch-p9px-956x","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-7wch-p9px-956x"},{"rule_id":"osv/GHSA-86w9-cpqp-85rv","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-86w9-cpqp-85rv","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-86w9-cpqp-85rv"},{"rule_id":"osv/GHSA-8hrf-8g6f-7xwp","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-8hrf-8g6f-7xwp","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-8hrf-8g6f-7xwp"},{"rule_id":"osv/GHSA-hqq3-7jhf-c5jx","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-hqq3-7jhf-c5jx","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-hqq3-7jhf-c5jx"},{"rule_id":"osv/GHSA-jc66-7q78-782g","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-jc66-7q78-782g","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-jc66-7q78-782g"},{"rule_id":"osv/GHSA-rhr8-3pm8-cq29","severity":"high","message":"node-forge@1.4.0 (npm) is affected by GHSA-rhr8-3pm8-cq29","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-rhr8-3pm8-cq29"},{"rule_id":"osv/GHSA-7w5x-hrqm-74c2","severity":"high","message":"smol-toml@1.6.1 (npm) is affected by GHSA-7w5x-hrqm-74c2","path":"package-lock.json","line":null,"fingerprint":"smol-toml@1.6.1 (npm):GHSA-7w5x-hrqm-74c2"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.29.1 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.2.1 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.1 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@4.1.10 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.10 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.10 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.10 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-525v-9gp9-w22h","severity":"medium","message":"node-forge@1.4.0 (npm) is affected by GHSA-525v-9gp9-w22h","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-525v-9gp9-w22h"},{"rule_id":"osv/GHSA-5cwg-6vw7-rj6p","severity":"medium","message":"node-forge@1.4.0 (npm) is affected by GHSA-5cwg-6vw7-rj6p","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-5cwg-6vw7-rj6p"},{"rule_id":"osv/GHSA-6cv4-p8m7-4r25","severity":"medium","message":"node-forge@1.4.0 (npm) is affected by GHSA-6cv4-p8m7-4r25","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-6cv4-p8m7-4r25"},{"rule_id":"osv/GHSA-6wvx-3r32-xmcg","severity":"medium","message":"node-forge@1.4.0 (npm) is affected by GHSA-6wvx-3r32-xmcg","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-6wvx-3r32-xmcg"},{"rule_id":"osv/GHSA-h46v-rmh6-fq4f","severity":"medium","message":"node-forge@1.4.0 (npm) is affected by GHSA-h46v-rmh6-fq4f","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-h46v-rmh6-fq4f"},{"rule_id":"osv/GHSA-j8rw-jp99-435v","severity":"medium","message":"node-forge@1.4.0 (npm) is affected by GHSA-j8rw-jp99-435v","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-j8rw-jp99-435v"},{"rule_id":"osv/GHSA-w4xr-hqv8-ch44","severity":"medium","message":"node-forge@1.4.0 (npm) is affected by GHSA-w4xr-hqv8-ch44","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-w4xr-hqv8-ch44"},{"rule_id":"osv/GHSA-r4xh-jqrq-34v2","severity":"medium","message":"smol-toml@1.6.1 (npm) is affected by GHSA-r4xh-jqrq-34v2","path":"package-lock.json","line":null,"fingerprint":"smol-toml@1.6.1 (npm):GHSA-r4xh-jqrq-34v2"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.29.1 (npm) is affected by GHSA-f72v-6w45-q472","path":"package-lock.json","line":null,"fingerprint":"undici@7.29.1 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.2.1 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.1 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.2.1 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.1 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.2.1 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.1 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-vfpm-58rq-9qcg","severity":"medium","message":"vite@8.2.1 (npm) is affected by GHSA-vfpm-58rq-9qcg","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.1 (npm):GHSA-vfpm-58rq-9qcg"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@4.1.10 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@4.1.10 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-g7r4-m6w7-qqqr","severity":"low","message":"esbuild@0.27.7 (npm) is affected by GHSA-g7r4-m6w7-qqqr","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.27.7 (npm):GHSA-g7r4-m6w7-qqqr"},{"rule_id":"osv/GHSA-2vgq-wchc-25w7","severity":"low","message":"node-forge@1.4.0 (npm) is affected by GHSA-2vgq-wchc-25w7","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-2vgq-wchc-25w7"},{"rule_id":"osv/GHSA-4487-j8r4-4g2f","severity":"low","message":"node-forge@1.4.0 (npm) is affected by GHSA-4487-j8r4-4g2f","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-4487-j8r4-4g2f"},{"rule_id":"osv/GHSA-4642-5mcj-2rqw","severity":"low","message":"node-forge@1.4.0 (npm) is affected by GHSA-4642-5mcj-2rqw","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-4642-5mcj-2rqw"},{"rule_id":"osv/GHSA-6889-vf6x-f3g5","severity":"low","message":"node-forge@1.4.0 (npm) is affected by GHSA-6889-vf6x-f3g5","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-6889-vf6x-f3g5"},{"rule_id":"osv/GHSA-9wg5-mj3p-v49q","severity":"low","message":"node-forge@1.4.0 (npm) is affected by GHSA-9wg5-mj3p-v49q","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-9wg5-mj3p-v49q"},{"rule_id":"osv/GHSA-h6cr-wjv9-3cpp","severity":"low","message":"node-forge@1.4.0 (npm) is affected by GHSA-h6cr-wjv9-3cpp","path":"package-lock.json","line":null,"fingerprint":"node-forge@1.4.0 (npm):GHSA-h6cr-wjv9-3cpp"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.2.1 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@8.2.1 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":5.0,"findings_high":3.0,"findings_medium":0.0,"findings_low":2.0,"penalty":27.9},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":14,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:16"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish.yml","line":16,"fingerprint":"cache-poisoning:.github/workflows/publish.yml:16"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":14,"fingerprint":"artipacked:.github/workflows/publish.yml:14"},{"rule_id":"zizmor/use-trusted-publishing","severity":"info","message":"prefer trusted publishing for authentication [confidence high]","path":".github/workflows/publish.yml","line":33,"fingerprint":"use-trusted-publishing:.github/workflows/publish.yml:33"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.01,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":4517.0,"function_nloc":50220.0,"mean_ccn":4.21,"p90_ccn":9.0,"complex_functions":174.0,"long_functions":47.0,"many_param_functions":4.0,"risky_nloc_share":0.3235},"findings":[],"evidence":[{"kind":"complex-function","description":"runCodexCommand in src/codex.ts: complexity 177, 602 lines","ref":"src/codex.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/codex.ts#L372","weight":1.0},{"kind":"complex-function","description":"parseArgs in src/cli.ts: complexity 170, 345 lines","ref":"src/cli.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/cli.ts#L170","weight":1.0},{"kind":"complex-function","description":"runCodexAppCommand in src/codex-app.ts: complexity 160, 485 lines","ref":"src/codex-app.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/codex-app.ts#L422","weight":1.0},{"kind":"complex-function","description":"runClaudeCommand in src/cli.ts: complexity 140, 547 lines","ref":"src/cli.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/cli.ts#L1245","weight":1.0},{"kind":"complex-function","description":"(anonymous) in src/codex-proxy.ts: complexity 129, 356 lines","ref":"src/codex-proxy.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/codex-proxy.ts#L628","weight":1.0},{"kind":"complex-function","description":"runPoolCommand in src/pool/command.ts: complexity 109, 210 lines","ref":"src/pool/command.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/pool/command.ts#L74","weight":1.0},{"kind":"complex-function","description":"handleUiApiRequest in src/ui/api.ts: complexity 99, 102 lines","ref":"src/ui/api.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/ui/api.ts#L166","weight":1.0},{"kind":"complex-function","description":"(anonymous) in src/codex-proxy.ts: complexity 90, 245 lines","ref":"src/codex-proxy.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/codex-proxy.ts#L1329","weight":1.0},{"kind":"complex-function","description":"effortProviderOptions in src/provider-factory.ts: complexity 75, 157 lines","ref":"src/provider-factory.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/provider-factory.ts#L2142","weight":1.0},{"kind":"complex-function","description":"runClaudeAppCommand in src/claude-app.ts: complexity 74, 247 lines","ref":"src/claude-app.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/claude-app.ts#L97","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":49472.0,"duplicated_lines":2170.0,"duplicated_share":0.0439,"files":278.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/antigravity.ts:215 and src/cli.ts:1538","ref":"src/antigravity.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity.ts#L215","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/antigravity.ts:591 and src/antigravity.ts:734","ref":"src/antigravity.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity.ts#L591","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/antigravity/cloud-code-gateway.ts:349 and src/antigravity/cloud-code-gateway.ts:366","ref":"src/antigravity/cloud-code-gateway.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity/cloud-code-gateway.ts#L349","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/antigravity/ide-profile.ts:26 and src/antigravity/ide-session.ts:216","ref":"src/antigravity/ide-profile.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity/ide-profile.ts#L26","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/antigravity/ide-session.ts:190 and src/antigravity/ide-session.ts:214","ref":"src/antigravity/ide-session.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity/ide-session.ts#L190","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/antigravity/launch-ide.ts:134 and src/antigravity/launch-ide.ts:146","ref":"src/antigravity/launch-ide.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity/launch-ide.ts#L134","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/antigravity/request-adapter.ts:255 and src/gemini-proxy.ts:183","ref":"src/antigravity/request-adapter.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/antigravity/request-adapter.ts#L255","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/catalog.ts:34 and src/claude-desktop/model-catalog.ts:108","ref":"src/catalog.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/catalog.ts#L34","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/claude-app.ts:137 and src/codex-app.ts:490","ref":"src/claude-app.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/claude-app.ts#L137","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/claude-desktop/app-launch.ts:192 and src/codex/app-launch.ts:315","ref":"src/claude-desktop/app-launch.ts","url":"https://github.com/jacob-bd/relay-ai/blob/b2709b5b9128e06d73ebb594928d4a1bb05ad07a/src/claude-desktop/app-launch.ts#L192","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":82.0,"weighted_findings":39.0,"scanned_lines":66638.0,"category:best-practice":13.0,"category:correctness":69.0},"findings":[{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how apiKey === 'local' is evaluated, this expression returns `keyring:provider:${providerId}`. This is probably a copy-paste error.","path":"src/registry/custom-endpoint.ts","line":212,"fingerprint":"typescript.lang.correctness.useless-ternary:src/registry/custom-endpoint.ts:212"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/antigravity/ide-profile.ts","line":31,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/antigravity/ide-profile.ts:31"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/antigravity/ide-session.ts","line":197,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/antigravity/ide-session.ts:197"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/antigravity/ide-session.ts","line":221,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/antigravity/ide-session.ts:221"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/antigravity/ide-session.ts","line":259,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/antigravity/ide-session.ts:259"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/antigravity/ide-session.ts","line":283,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/antigravity/ide-session.ts:283"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/codex-proxy.ts","line":190,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/codex-proxy.ts:190"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/codex/app-launch.ts","line":93,"fingerprint":"javascript.lang.correctness.no-replaceall:src/codex/app-launch.ts:93"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/core/antigravity-diagnostics.ts","line":14,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/core/antigravity-diagnostics.ts:14"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/core/antigravity-diagnostics.ts","line":85,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/core/antigravity-diagnostics.ts:85"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/http-proxy/server.ts","line":422,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/http-proxy/server.ts:422"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/pool/claude-signatures.ts","line":25,"fingerprint":"javascript.lang.correctness.no-replaceall:src/pool/claude-signatures.ts:25"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/ui-command.ts","line":111,"fingerprint":"javascript.lang.correctness.no-replaceall:src/ui-command.ts:111"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/ui-command.ts","line":111,"fingerprint":"javascript.lang.correctness.no-replaceall:src/ui-command.ts:111"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/ui/api.ts","line":431,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/ui/api.ts:431"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/ui/public/app.js","line":4574,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/ui/public/app.js:4574"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/ui/public/app.js","line":4579,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/ui/public/app.js:4579"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/ui/public/app.js","line":4689,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/ui/public/app.js:4689"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/ui/public/app.js","line":4692,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/ui/public/app.js:4692"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/ui/public/app.js","line":4702,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/ui/public/app.js:4702"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/ui/public/app.js","line":4711,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/ui/public/app.js:4711"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/ui/public/app.js","line":4721,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/ui/public/app.js:4721"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ai-doc.ts","line":275,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ai-doc.ts:275"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":325,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:325"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":325,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:325"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/cloud-code-gateway.ts","line":325,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/cloud-code-gateway.ts:325"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/launch-ide.ts","line":82,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/launch-ide.ts:82"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/launch-ide.ts","line":82,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/launch-ide.ts:82"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/launch-ide.ts","line":97,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/launch-ide.ts:97"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/antigravity/launch-ide.ts","line":97,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/antigravity/launch-ide.ts:97"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/claude-desktop/app-launch.ts","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/claude-desktop/app-launch.ts:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/claude-desktop/app-launch.ts","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/claude-desktop/app-launch.ts:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/codex-proxy.ts","line":1333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/codex-proxy.ts:1333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/codex-proxy.ts","line":1333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/codex-proxy.ts:1333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/codex-proxy.ts","line":1333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/codex-proxy.ts:1333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/codex/app-launch.ts","line":326,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/codex/app-launch.ts:326"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/codex/app-launch.ts","line":326,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/codex/app-launch.ts:326"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/codex/app-launch.ts","line":439,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/codex/app-launch.ts:439"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/codex/app-launch.ts","line":439,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/codex/app-launch.ts:439"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":80,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:80"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":80,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:80"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":80,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:80"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":84,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:84"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":87,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/antigravity-diagnostics.ts","line":87,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/antigravity-diagnostics.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/favorites-picker.ts","line":116,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/favorites-picker.ts:116"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/favorites-picker.ts","line":116,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/favorites-picker.ts:116"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/favorites-picker.ts","line":116,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/favorites-picker.ts:116"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":238,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:238"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":238,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:238"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":238,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:238"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":238,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:238"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":311,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:311"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":311,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:311"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":311,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:311"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":311,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:311"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":311,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:311"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":311,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:311"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":325,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:325"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/openai-adapter.ts","line":325,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/openai-adapter.ts:325"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/pool/activity.ts","line":109,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/pool/activity.ts:109"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/pool/activity.ts","line":109,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/pool/activity.ts:109"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/pool/activity.ts","line":315,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/pool/activity.ts:315"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/pool/activity.ts","line":315,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/pool/activity.ts:315"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/proxy.ts","line":464,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/proxy.ts:464"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/proxy.ts","line":464,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/proxy.ts:464"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/proxy.ts","line":464,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/proxy.ts:464"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/public/app.js","line":4926,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/public/app.js:4926"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/public/app.js","line":4926,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/public/app.js:4926"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/public/app.js","line":4926,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/public/app.js:4926"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/public/app.js","line":4985,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/public/app.js:4985"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/public/app.js","line":4985,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/public/app.js:4985"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/public/provider-model-browser.js","line":84,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/public/provider-model-browser.js:84"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/public/provider-model-browser.js","line":84,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/public/provider-model-browser.js:84"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":55418.0,"source_lines":66638.0,"test_ratio":0.8316,"ci_files":1.0,"cochange_share":0.9352,"cochange_commits":216.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/publish.yml","ref":".github/workflows/publish.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":519.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":76.0,"escapes_per_kloc":1.249},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":11092.0,"other_lines":55546.0,"files_blamed":278.0,"blame_failures":0.0,"quality:ai_findings":10.0,"quality:ai_per_kloc":0.902,"quality:other_findings":72.0,"quality:other_per_kloc":1.296,"quality:ratio":0.7,"security:ai_findings":71.0,"security:ai_per_kloc":6.401,"security:other_findings":96.0,"security:other_per_kloc":1.728,"security:ratio":3.7},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}