{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:05.381498Z","repo":{"ref":{"host":"github.com","owner":"javatarz","name":"credit-card-lending"},"default_branch":"main","clone_url":"https://github.com/javatarz/credit-card-lending.git","html_url":"https://github.com/javatarz/credit-card-lending","description":"What happens when you build software with AI as a true collaborator? Exploring intelligent Engineering (iE) through a credit card lending platform — TDD, context docs for LLMs, and automated workflows.","stars":4,"forks":2,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":499,"primary_language":"Java","license_spdx":"MIT","created_at":"2025-12-01T08:42:03Z","pushed_at":"2026-04-09T01:01:13Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-07-12T20:43:43Z","owner_type":"User","release_assets":[]}},"commit_sha":"a9def029ca8d9a7478eb64817da24553cbed0881","profile":{"lines_by_language":{"Java":2059,"Kotlin":341,"Shell":76},"files_by_category":{"source":55,"docs":43,"config":10,"test":9,"other":4,"generated":3,"binary":1},"source_lines":1745,"test_lines":731},"pillars":{"ai_provenance":{"score":99.6,"confidence":0.91,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.996,"suspected_share":0.0,"estimated_share":0.996,"ai_artifacts":9.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":81.5,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":100.0,"duplication":65.5,"lint":100.0,"testing":65.9,"docs":80.0,"type_safety":null,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.42, no CI test run detected; 0% of function code in complex or long functions; 7% duplicated lines. Weakest area: duplication."},"security":{"score":68.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":90.5,"sast":95.1,"dependencies":null,"ci_actions":27.8,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 6 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":84.0,"attributed_commits":71.0,"attributed_commit_share":0.8452380952380952,"effective_loc":2770.0,"attributed_loc":2759.0,"attributed_loc_share":0.996028880866426,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 71 attributed commits, 2,759 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ca1d9eb04ddbe3f22ccc1aeb2f23931d0f941144","url":"https://github.com/javatarz/credit-card-lending/commit/ca1d9eb04ddbe3f22ccc1aeb2f23931d0f941144","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"decae2dad47a94e29f99f346c846992d8d46a437","url":"https://github.com/javatarz/credit-card-lending/commit/decae2dad47a94e29f99f346c846992d8d46a437","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"54e26fb25862aaf8af276f87d8766cddf2a47190","url":"https://github.com/javatarz/credit-card-lending/commit/54e26fb25862aaf8af276f87d8766cddf2a47190","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"46c6a718931241977811b70e50af8428caf4f099","url":"https://github.com/javatarz/credit-card-lending/commit/46c6a718931241977811b70e50af8428caf4f099","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"26b3f482a0fe5172ad24019d517ba256279eb528","url":"https://github.com/javatarz/credit-card-lending/commit/26b3f482a0fe5172ad24019d517ba256279eb528","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"0e90cbdf6404bfdb7222de8d1edd57cc48e1d109","url":"https://github.com/javatarz/credit-card-lending/commit/0e90cbdf6404bfdb7222de8d1edd57cc48e1d109","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"01835b2fbbf5a608fe0fa8a08a8b7773a09f17d9","url":"https://github.com/javatarz/credit-card-lending/commit/01835b2fbbf5a608fe0fa8a08a8b7773a09f17d9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d9a7c3ca1d514489e834fea1ecac3adf5ce82933","url":"https://github.com/javatarz/credit-card-lending/commit/d9a7c3ca1d514489e834fea1ecac3adf5ce82933","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1d3d9e047cb20c7e631690fc5e4a8e6badfbd484","url":"https://github.com/javatarz/credit-card-lending/commit/1d3d9e047cb20c7e631690fc5e4a8e6badfbd484","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"aff3b90963f1c4b521df80d89a6ae6cdd7fe8960","url":"https://github.com/javatarz/credit-card-lending/commit/aff3b90963f1c4b521df80d89a6ae6cdd7fe8960","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6f97f175b2460d14f8145f29f4aea0b1ea5e8ccd","url":"https://github.com/javatarz/credit-card-lending/commit/6f97f175b2460d14f8145f29f4aea0b1ea5e8ccd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7c079468c4c5721fccbc5c18c1497ac93ab3d9d0","url":"https://github.com/javatarz/credit-card-lending/commit/7c079468c4c5721fccbc5c18c1497ac93ab3d9d0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"408df7d5e8414cfaed36e45f5b858d5d52e74b7d","url":"https://github.com/javatarz/credit-card-lending/commit/408df7d5e8414cfaed36e45f5b858d5d52e74b7d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f742f31adf936a711fab1e959bafcc41687cb1ec","url":"https://github.com/javatarz/credit-card-lending/commit/f742f31adf936a711fab1e959bafcc41687cb1ec","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1893e715d1f7c850b04a97263f65df2dedd928b1","url":"https://github.com/javatarz/credit-card-lending/commit/1893e715d1f7c850b04a97263f65df2dedd928b1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"923b0228483f3da0f7e45fa262ea934ca9879801","url":"https://github.com/javatarz/credit-card-lending/commit/923b0228483f3da0f7e45fa262ea934ca9879801","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"73e7b74f4d096ad1a56dcd9099e5cce9269bcd81","url":"https://github.com/javatarz/credit-card-lending/commit/73e7b74f4d096ad1a56dcd9099e5cce9269bcd81","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"77680869039224fd84e4355124c386a70b9b3150","url":"https://github.com/javatarz/credit-card-lending/commit/77680869039224fd84e4355124c386a70b9b3150","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"480f5c5e54b72ed90c4ff1cbae2d3069de4057f3","url":"https://github.com/javatarz/credit-card-lending/commit/480f5c5e54b72ed90c4ff1cbae2d3069de4057f3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bbcbb82de1756b2e3a927246734d9cd5c18b3a09","url":"https://github.com/javatarz/credit-card-lending/commit/bbcbb82de1756b2e3a927246734d9cd5c18b3a09","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a9d76ccdcbd4969ceb93cecfb9d9a97c72598346","url":"https://github.com/javatarz/credit-card-lending/commit/a9d76ccdcbd4969ceb93cecfb9d9a97c72598346","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f397491279943a67b049a7d7d2f855be0a619a36","url":"https://github.com/javatarz/credit-card-lending/commit/f397491279943a67b049a7d7d2f855be0a619a36","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"dc7a09eb9689e7ee3f3ebac0d830f15b0f48ba76","url":"https://github.com/javatarz/credit-card-lending/commit/dc7a09eb9689e7ee3f3ebac0d830f15b0f48ba76","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5563cc8ff93980d05940c08197318ef44d23f5e0","url":"https://github.com/javatarz/credit-card-lending/commit/5563cc8ff93980d05940c08197318ef44d23f5e0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f9d1f3247dfb6dc954843e3719657d6902cc48e0","url":"https://github.com/javatarz/credit-card-lending/commit/f9d1f3247dfb6dc954843e3719657d6902cc48e0","weight":0.9}],"data":{"attributed_loc_by_commit":{"f61f810f298f6d4de934b53e5a679bdf0252d445":0,"4d29bf66bd34bb54b7674f9da310ffd941699fcf":0,"a26a3d9d03dfa3bd470b9f70d58baee56ffd5802":0,"ae51cdd1f8fd09c1a5cdf2742f1f18e397fd6653":0,"6f53c5ec3cae8027def5792ca3503fc60157559e":0,"75f70da9842f60a95ff3beffc1ad2ed7cdbbe054":0,"947b7dc67b2545d7799f2af1b8a44e67f86bcf51":0,"25de1c88722e52999b40345419b342cdbfa10335":0,"0b7fd0862d280664d9c74e1a10979bb80e2dfd1e":0,"a188bd99ef7257e740aa864365187a97645e9377":345,"1364e38bf557209b29cbf8944e554c4e9f9fe2c5":0,"68ac5d0cfbc3f0eaf372a18b8271b145e2633726":0,"bfdf3814171f432b02107e86e6c9b5f0041a47a0":0,"2bc690a74c735d505493f0928e80ab5c4b9ad5c0":114,"8a0bb19f8801100f1894bb5cf3a08b4c34258878":0,"0e2fe6befbb4b3c18289c146946912c0749d9a54":13,"1767dce614e7ac72ea84e2cf6929555090bff8b6":0,"c0f3881e1fdc842c4751668f4636bf9cc138deaa":135,"0f461bb21e4e34801c62e49f0e8ee2199b800a20":35,"fc04f60b9ba3bd7ac06d42ed052c49d4c613b095":44,"f05e43ae69a1a6ef3d2b2fde8221ed74ed340dda":74,"77b13e31de47d110ea370af336558b974c187ac2":42,"84ecb6a42e820fbbc568356c7a89fd46e37b26d2":104,"deb7050a2a219ac618935d762d6cd349750969d3":0,"228f899fa2e27dc03cf3db6dafc52d500663afbb":10,"dcc3a4639c9e058dea3b3d25366c70f2b13a81e8":0,"7eaa60f637dd0088611fec116633363cc34c0c0d":0,"a99091c093f8ae261d4fd3a80d446f3001eb1385":0,"7d128fcdd87c1a62b8bbbb2f52dbbc86726575bb":0,"c194d047998db9ef0a69e96f59a75a4041e7c9f8":92,"51718ee2078e99751ea94f89f538d578dcf5e8db":0,"96e163881dd3bd6bea18f8a4d39702b0e3ecd303":87,"ed840cbc82d8d694f0bfa65b3cd8506931d12e69":13,"a897455e62d2f88d2739ad797f1a51ee39b546ba":93,"4c3dac29d669e6b540f6e11d10568becbdea7809":347,"625a615b3aaed5e0b78bec1e8eb7209777eedb07":0,"de9e6920d061a0aacb8d772f5ba002bbd0e15dcc":0,"6a2823115fc16dfc45d133b51bb9ab966f26f7d5":0,"a84ba128c8c2c0f1cd6e94c6a1d4466c7dd4f78a":0,"93bf56091c5647a706167e94afdb44ee88dea089":17,"27850e28d6466d6fb09f3689d3e1ce3de34a81c9":79,"6e6b65c595645ff64b7baa5f3a5c74f1751302b6":182,"7d8276239404ce06a228fc8edc1dbb1c863c0d6a":11,"0974aa0c042de0a3641c994226de232836895d36":148,"b4ca7e2bf16f69ae0055faa5232e27acc071b252":278,"561cc89dc3bb924fd8ab198b119b90c33b3b387a":121,"f9d1f3247dfb6dc954843e3719657d6902cc48e0":51,"5563cc8ff93980d05940c08197318ef44d23f5e0":0,"dc7a09eb9689e7ee3f3ebac0d830f15b0f48ba76":0,"f397491279943a67b049a7d7d2f855be0a619a36":81,"a9d76ccdcbd4969ceb93cecfb9d9a97c72598346":114,"bbcbb82de1756b2e3a927246734d9cd5c18b3a09":129,"480f5c5e54b72ed90c4ff1cbae2d3069de4057f3":0,"77680869039224fd84e4355124c386a70b9b3150":0,"73e7b74f4d096ad1a56dcd9099e5cce9269bcd81":0,"923b0228483f3da0f7e45fa262ea934ca9879801":0,"1893e715d1f7c850b04a97263f65df2dedd928b1":0,"f742f31adf936a711fab1e959bafcc41687cb1ec":0,"7c079468c4c5721fccbc5c18c1497ac93ab3d9d0":0,"408df7d5e8414cfaed36e45f5b858d5d52e74b7d":0,"6f97f175b2460d14f8145f29f4aea0b1ea5e8ccd":0,"aff3b90963f1c4b521df80d89a6ae6cdd7fe8960":0,"1d3d9e047cb20c7e631690fc5e4a8e6badfbd484":0,"d9a7c3ca1d514489e834fea1ecac3adf5ce82933":0,"01835b2fbbf5a608fe0fa8a08a8b7773a09f17d9":0,"0e90cbdf6404bfdb7222de8d1edd57cc48e1d109":0,"26b3f482a0fe5172ad24019d517ba256279eb528":0,"46c6a718931241977811b70e50af8428caf4f099":0,"54e26fb25862aaf8af276f87d8766cddf2a47190":0,"decae2dad47a94e29f99f346c846992d8d46a437":0,"ca1d9eb04ddbe3f22ccc1aeb2f23931d0f941144":0},"tools":{"claude-code":{"name":"Claude Code","commits":71,"loc":2759,"first_seen":1764578497,"last_seen":1767380103}},"monthly":{"2025-12":{"loc":2759,"attributed_loc":2759},"2026-01":{"loc":0,"attributed_loc":0},"2026-02":{"loc":11,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":9.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1764579319.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/commands/check-drift.md (claude-code configuration)","ref":".claude/commands/check-drift.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/commands/check-drift.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/pickup.md (claude-code configuration)","ref":".claude/commands/pickup.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/commands/pickup.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/start-dev.md (claude-code configuration)","ref":".claude/commands/start-dev.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/commands/start-dev.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/tour.md (claude-code configuration)","ref":".claude/commands/tour.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/commands/tour.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/update-context.md (claude-code configuration)","ref":".claude/commands/update-context.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/commands/update-context.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/review/SKILL.md (claude-code configuration)","ref":".claude/skills/review/SKILL.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/skills/review/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/tdd/SKILL.md (claude-code configuration)","ref":".claude/skills/tdd/SKILL.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/skills/tdd/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/wiki/SKILL.md (claude-code configuration)","ref":".claude/skills/wiki/SKILL.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/.claude/skills/wiki/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/commands/check-drift.md","added_at":1767283047},{"tool":"claude-code","path":".claude/commands/pickup.md","added_at":1764685281},{"tool":"claude-code","path":".claude/commands/start-dev.md","added_at":1764733215},{"tool":"claude-code","path":".claude/commands/tour.md","added_at":1767380097},{"tool":"claude-code","path":".claude/commands/update-context.md","added_at":1764689767},{"tool":"claude-code","path":".claude/skills/review/SKILL.md","added_at":1766509949},{"tool":"claude-code","path":".claude/skills/tdd/SKILL.md","added_at":1766509949},{"tool":"claude-code","path":".claude/skills/wiki/SKILL.md","added_at":1766504240},{"tool":"claude-code","path":"CLAUDE.md","added_at":1764579319}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":10.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2557.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":210.62686567164178,"median_loc_per_hour":75.82244835965977,"pr_timed_units":1.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1745.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":2.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"shared/infrastructure/src/test/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionServiceTest.java","line":11,"fingerprint":"shared/infrastructure/src/test/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionServiceTest.java:generic-api-key:11"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"platform/api-gateway/src/main/resources/application.yml","line":52,"fingerprint":"platform/api-gateway/src/main/resources/application.yml:generic-api-key:52"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit a26a3d9d03); removed from the current tree but still retrievable","path":"docs/epics/E01-customer-onboarding.md","line":96,"fingerprint":"a26a3d9d03dfa3bd470b9f70d58baee56ffd5802:docs/epics/E01-customer-onboarding.md:generic-api-key:96"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":4.0,"weighted_findings":0.25,"scanned_lines":1745.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/java.lang.security.audit.crypto.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different. Unlike the Key, the IV usually does not  [confidence low]","path":"shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java","line":36,"fingerprint":"java.lang.security.audit.crypto.gcm-detection:shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java:36"},{"rule_id":"opengrep/java.lang.security.audit.crypto.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different. Unlike the Key, the IV usually does not  [confidence low]","path":"shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java","line":37,"fingerprint":"java.lang.security.audit.crypto.gcm-detection:shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java:37"},{"rule_id":"opengrep/java.lang.security.audit.crypto.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different. Unlike the Key, the IV usually does not  [confidence low]","path":"shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java","line":63,"fingerprint":"java.lang.security.audit.crypto.gcm-detection:shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java:63"},{"rule_id":"opengrep/java.lang.security.audit.crypto.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different. Unlike the Key, the IV usually does not  [confidence low]","path":"shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java","line":64,"fingerprint":"java.lang.security.audit.crypto.gcm-detection:shared/infrastructure/src/main/java/me/karun/bank/credit/infrastructure/encryption/AwsSecretsManagerEncryptionService.java:64"}],"evidence":[],"data":{"rulesets":["java","kotlin","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":9.0,"findings_high":6.0,"findings_medium":3.0,"findings_low":0.0,"penalty":76.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-test.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/build-and-test.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-test.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/build-and-test.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-test.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/build-and-test.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-and-test.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/build-and-test.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/check-doc-links.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/check-doc-links.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/check-doc-links.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/check-doc-links.yml:21"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-and-test.yml","line":19,"fingerprint":"artipacked:.github/workflows/build-and-test.yml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/check-doc-links.yml","line":17,"fingerprint":"artipacked:.github/workflows/check-doc-links.yml:17"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/check-doc-links.yml","line":14,"fingerprint":"excessive-permissions:.github/workflows/check-doc-links.yml:14"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.7738,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":72.0,"function_nloc":546.0,"mean_ccn":1.46,"p90_ccn":3.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1020.0,"duplicated_lines":72.0,"duplicated_share":0.0706,"files":55.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: buildSrc/src/main/kotlin/CreateModuleTask.kt:66 and shared/infrastructure/build.gradle.kts:1","ref":"buildSrc/src/main/kotlin/CreateModuleTask.kt","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/buildSrc/src/main/kotlin/CreateModuleTask.kt#L66","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: buildSrc/src/main/kotlin/CreateModuleTask.kt:80 and modules/customer/build.gradle.kts:16","ref":"buildSrc/src/main/kotlin/CreateModuleTask.kt","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/buildSrc/src/main/kotlin/CreateModuleTask.kt#L80","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: modules/customer/src/main/java/me/karun/bank/credit/customer/internal/domain/CustomerProfile.java:47 and modules/customer/src/main/java/me/karun/bank/credit/customer/internal/domain/CustomerProfile.java:107","ref":"modules/customer/src/main/java/me/karun/bank/credit/customer/internal/domain/CustomerProfile.java","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/modules/customer/src/main/java/me/karun/bank/credit/customer/internal/domain/CustomerProfile.java#L47","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: modules/customer/src/main/java/me/karun/bank/credit/customer/internal/service/CustomerServiceImpl.java:226 and modules/customer/src/main/java/me/karun/bank/credit/customer/internal/service/CustomerServiceImpl.java:238","ref":"modules/customer/src/main/java/me/karun/bank/credit/customer/internal/service/CustomerServiceImpl.java","url":"https://github.com/javatarz/credit-card-lending/blob/a9def029ca8d9a7478eb64817da24553cbed0881/modules/customer/src/main/java/me/karun/bank/credit/customer/internal/service/CustomerServiceImpl.java#L226","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":1745.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8378,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":731.0,"source_lines":1745.0,"test_ratio":0.4189,"ci_files":2.0,"cochange_share":0.7037,"cochange_commits":27.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build-and-test.yml","ref":".github/workflows/build-and-test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/check-doc-links.yml","ref":".github/workflows/check-doc-links.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":149.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":1734.0,"other_lines":11.0,"files_blamed":55.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":4.0,"security:ai_per_kloc":2.307,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}