{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:50:24.994381Z","repo":{"ref":{"host":"github.com","owner":"jaylikesbunda","name":"CrashoftheTitans-Wiicomp"},"default_branch":"main","clone_url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp.git","html_url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp","description":"Recompilation of the Wii version of Crash of the Titans","stars":6,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":8387,"primary_language":"Python","license_spdx":"NOASSERTION","created_at":"2026-10-18T07:46:05Z","pushed_at":"2026-11-11T14:37:45Z","security_policy_url":null,"distribution":{"owner_created_at":"2023-05-10T09:34:52Z","owner_type":"User","release_assets":[{"name":"CrashLauncher-0.1.9-windows-x64-setup.exe","size":166360954,"download_count":115,"release_tag":"v0.1.9","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.9/CrashLauncher-0.1.9-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":5,"release_tag":"v0.1.9","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.9/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.8-windows-x64-setup.exe","size":165982839,"download_count":193,"release_tag":"v0.1.8","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.8/CrashLauncher-0.1.8-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":5,"release_tag":"v0.1.8","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.8/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.7-windows-x64-setup.exe","size":165969300,"download_count":21,"release_tag":"v0.1.7","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.7/CrashLauncher-0.1.7-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":2,"release_tag":"v0.1.7","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.7/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.6-windows-x64-setup.exe","size":165990890,"download_count":13,"release_tag":"v0.1.6","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.6/CrashLauncher-0.1.6-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":2,"release_tag":"v0.1.6","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.6/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.5-windows-x64-setup.exe","size":165957816,"download_count":18,"release_tag":"v0.1.5","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.5/CrashLauncher-0.1.5-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":2,"release_tag":"v0.1.5","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.5/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.4-windows-x64-setup.exe","size":165967107,"download_count":72,"release_tag":"v0.1.4","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.4/CrashLauncher-0.1.4-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":2,"release_tag":"v0.1.4","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.4/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.3-windows-x64-setup.exe","size":165971734,"download_count":375,"release_tag":"v0.1.3","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.3/CrashLauncher-0.1.3-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":8,"release_tag":"v0.1.3","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.3/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.2-windows-x64-setup.exe","size":165970928,"download_count":4,"release_tag":"v0.1.2","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.2/CrashLauncher-0.1.2-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":1,"release_tag":"v0.1.2","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.2/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.1-windows-x64-setup.exe","size":165968282,"download_count":4,"release_tag":"v0.1.1","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.1/CrashLauncher-0.1.1-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":1,"release_tag":"v0.1.1","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.1/SHA256SUMS.txt"},{"name":"CrashLauncher-0.1.0-windows-x64-setup.exe","size":168290672,"download_count":3,"release_tag":"v0.1.0","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.0/CrashLauncher-0.1.0-windows-x64-setup.exe"},{"name":"SHA256SUMS.txt","size":109,"download_count":1,"release_tag":"v0.1.0","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.0/SHA256SUMS.txt"}]}},"commit_sha":"25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8","profile":{"lines_by_language":{"Python":52705,"C++":17970,"C":13083,"Rust":4192,"JavaScript":965,"PowerShell":6},"files_by_category":{"source":665,"binary":317,"other":52,"config":35,"docs":9,"oversized":5,"generated":1,"vendored":1},"source_lines":88921,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.48,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.1141,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":54.0,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":35.2,"duplication":68.9,"lint":80.0,"testing":35.0,"docs":85.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, CI runs tests; 35% of function code in complex or long functions; 6% duplicated lines. Weakest area: testing."},"security":{"score":47.4,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":36.7,"dependencies":42.7,"ci_actions":11.8,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 32 known vulnerabilities in 13 dependencies; 260 high-severity SAST findings; 11 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":14.0,"checked":14.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":32.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":89007.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-10":{"loc":88243,"attributed_loc":0},"2026-11":{"loc":764,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":12.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":10982.0,"flagged_loc":10156.0,"flagged_loc_share":0.9247860134765981,"max_loc_per_hour":2536.3579604578567,"median_loc_per_hour":70.75,"pr_timed_units":0.0,"excluded_import_loc":78025.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"10,156 lines of first-party code in ~4.0h (2,536 lines/hour, 2 commit session)","ref":"97d801f2efca66f18d2d7e2718e859501a20a1ab","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/commit/97d801f2efca66f18d2d7e2718e859501a20a1ab","weight":0.6}],"data":{"flagged_loc_by_commit":{"92fd99bb0dbc97d2c3ac6fb23d9043784b80feab":5013,"97d801f2efca66f18d2d7e2718e859501a20a1ab":5143},"excluded_import_commits":["18fdb56d9b277f2ffc057cc5301de1bf1328ad96","192f53bd7dabfaa0e2b0a5823c33f04f60944e66","c728baf7bc1c6d17a927988b9ec4a0d07905c026"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":9.0,"flagged_releases":0.0,"max_loc_per_day":614.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1.0","to":"v0.1.1","loc":38,"days":0.25,"loc_per_day":152.9,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":9,"days":0.26,"loc_per_day":34.4,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":15,"days":0.27,"loc_per_day":56.1,"flagged":false},{"from":"v0.1.3","to":"v0.1.4","loc":16,"days":6.95,"loc_per_day":2.3,"flagged":false},{"from":"v0.1.4","to":"v0.1.5","loc":10,"days":0.68,"loc_per_day":14.8,"flagged":false},{"from":"v0.1.5","to":"v0.1.6","loc":128,"days":0.4,"loc_per_day":323.3,"flagged":false},{"from":"v0.1.6","to":"v0.1.7","loc":116,"days":0.19,"loc_per_day":614.0,"flagged":false},{"from":"v0.1.7","to":"v0.1.8","loc":41,"days":0.31,"loc_per_day":133.6,"flagged":false},{"from":"v0.1.8","to":"v0.1.9","loc":453,"days":5.58,"loc_per_day":81.2,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":88921.0,"index":0.022,"count:narrated_steps":2.0,"per_kloc:narrated_steps":0.022,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, we need to send the contents of our AUX buffers to the CPU.","ref":"reference/dolphin-ax/AX.cpp:514","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AX.cpp#L514","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Then, we read the new temp from the CPU and add to our current","ref":"reference/dolphin-ax/AX.cpp:525","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AX.cpp#L525","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":310.0,"findings_high":260.0,"findings_medium":43.0,"findings_low":7.0,"weighted_findings":254.75,"scanned_lines":88915.0,"parse_errors":9.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":125,"fingerprint":"javascript.browser.security.insecure-document-method:launcher/ui/app.js:125"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `host.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":125,"fingerprint":"javascript.browser.security.insecure-innerhtml:launcher/ui/app.js:125"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":686,"fingerprint":"javascript.browser.security.insecure-document-method:launcher/ui/app.js:686"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$(\"players\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":686,"fingerprint":"javascript.browser.security.insecure-innerhtml:launcher/ui/app.js:686"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":739,"fingerprint":"javascript.browser.security.insecure-document-method:launcher/ui/app.js:739"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$(\"mapRows\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":739,"fingerprint":"javascript.browser.security.insecure-innerhtml:launcher/ui/app.js:739"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":857,"fingerprint":"javascript.browser.security.insecure-document-method:launcher/ui/app.js:857"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$(\"motionRows\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":857,"fingerprint":"javascript.browser.security.insecure-innerhtml:launcher/ui/app.js:857"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":932,"fingerprint":"javascript.browser.security.insecure-document-method:launcher/ui/app.js:932"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `host.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":932,"fingerprint":"javascript.browser.security.insecure-innerhtml:launcher/ui/app.js:932"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/analyze_cpu_profile.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/analyze_cpu_profile.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/analyze_cpu_profile.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/analyze_cpu_profile.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/analyze_cpu_profile.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/analyze_cpu_profile.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/analyze_cpu_profile.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/analyze_cpu_profile.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/analyze_cpu_profile.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/analyze_cpu_profile.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/analyze_cpu_profile.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/analyze_cpu_profile.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/bench_guest_ram_fast.py","line":56,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/bench_guest_ram_fast.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/bench_guest_ram_fast.py","line":56,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/bench_guest_ram_fast.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/bench_guest_region_poll.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/bench_guest_region_poll.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/bench_guest_region_poll.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/bench_guest_region_poll.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/bench_guest_region_poll.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/bench_guest_region_poll.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/bench_guest_region_poll.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/bench_guest_region_poll.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/build_native.py","line":43,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/build_native.py:43"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/build_restrict_variant.py","line":17,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/build_restrict_variant.py:17"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/build_restrict_variant.py","line":17,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/build_restrict_variant.py:17"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_ai_registers.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_ai_registers.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_audio_worker.py","line":69,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_audio_worker.py:69"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_audit_speedups.py","line":104,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_audit_speedups.py:104"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_audit_speedups.py","line":104,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_audit_speedups.py:104"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_audit_speedups.py","line":111,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_audit_speedups.py:111"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_ax_backend.py","line":78,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_ax_backend.py:78"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_broad_stage.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_broad_stage.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_broad_stage.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_broad_stage.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_cache_bounds.py","line":16,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_cache_bounds.py:16"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_cache_range_loops.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_cache_range_loops.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_cache_range_loops.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_cache_range_loops.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_camera_glide.py","line":312,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_camera_glide.py:312"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_camera_glide.py","line":339,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_camera_glide.py:339"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_camera_glide.py","line":462,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_camera_glide.py:462"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_default_watch_hot.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_default_watch_hot.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_dense_dispatch.py","line":37,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_dense_dispatch.py:37"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_deterministic_wakeups.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_deterministic_wakeups.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_direct_texcoord_loader.py","line":50,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_direct_texcoord_loader.py:50"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_direct_texcoord_loader.py","line":55,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_direct_texcoord_loader.py:55"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_direct_texcoord_loader.py","line":98,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_direct_texcoord_loader.py:98"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_direct_texcoord_loader.py","line":100,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_direct_texcoord_loader.py:100"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_direct_texcoord_loader.py","line":102,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_direct_texcoord_loader.py:102"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_dispatch_switch.py","line":55,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_dispatch_switch.py:55"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_display_list_gpu_ownership.py","line":48,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_display_list_gpu_ownership.py:48"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_draw_followups.py","line":131,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_draw_followups.py:131"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_draw_followups.py","line":131,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_draw_followups.py:131"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_draw_followups.py","line":137,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_draw_followups.py:137"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_draw_followups.py","line":137,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_draw_followups.py:137"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_early_gpu_signal.py","line":108,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_early_gpu_signal.py:108"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_event_mask.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_event_mask.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_census.py","line":68,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_census.py:68"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_census.py","line":79,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_census.py:79"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_census.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_census.py:81"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_census.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_census.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_gates.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_gates.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_gates.py","line":49,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_gates.py:49"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_gates.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_gates.py:54"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fallback_gates.py","line":56,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fallback_gates.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fast_steady_clock.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fast_steady_clock.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fastmem_static_base.py","line":156,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fastmem_static_base.py:156"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_fastmem_static_base.py","line":156,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_fastmem_static_base.py:156"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fastmem_static_base.py","line":163,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fastmem_static_base.py:163"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_fastmem_static_base.py","line":163,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_fastmem_static_base.py:163"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fastmem_static_base.py","line":187,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fastmem_static_base.py:187"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fifo_ok_flag.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fifo_ok_flag.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fifo_ok_flag.py","line":111,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fifo_ok_flag.py:111"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fifo_ownership_transfer.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fifo_ownership_transfer.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fifo_ownership_transfer.py","line":44,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fifo_ownership_transfer.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_format_loaders.py","line":102,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_format_loaders.py:102"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fp_witness.py","line":13,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fp_witness.py:13"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_frame_limit.py","line":98,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_frame_limit.py:98"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_frame_limit.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_frame_limit.py:106"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_fused_batch.py","line":55,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_fused_batch.py:55"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_gather_redirect_span.py","line":100,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_gather_redirect_span.py:100"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_gl_state_redundancy.py","line":86,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_gl_state_redundancy.py:86"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_gl_state_redundancy.py","line":88,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_gl_state_redundancy.py:88"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_gl_state_redundancy.py","line":91,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_gl_state_redundancy.py:91"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_gpu_decode.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_gpu_decode.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_gpu_vertex_pipeline.py","line":94,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_gpu_vertex_pipeline.py:94"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_arena.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_arena.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_batch.py","line":355,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_batch.py:355"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_batch.py","line":355,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_batch.py:355"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_batch.py","line":359,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_batch.py:359"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_batch.py","line":359,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_batch.py:359"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_batch.py","line":373,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_batch.py:373"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_batch.py","line":373,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_batch.py:373"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_cfg_demand.py","line":733,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_cfg_demand.py:733"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_cfg_demand.py","line":737,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_cfg_demand.py:737"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_execution_region.py","line":174,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_execution_region.py:174"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_execution_region.py","line":174,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_execution_region.py:174"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_execution_region.py","line":177,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_execution_region.py:177"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_execution_region.py","line":177,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_execution_region.py:177"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_f32_transport.py","line":374,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_f32_transport.py:374"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_f32_transport.py","line":374,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_f32_transport.py:374"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_f32_transport.py","line":380,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_f32_transport.py:380"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_f32_transport.py","line":380,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_f32_transport.py:380"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_fact_flow.py","line":589,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_fact_flow.py:589"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_fact_flow.py","line":633,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_fact_flow.py:633"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_fact_flow.py","line":640,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_fact_flow.py:640"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_fact_flow.py","line":650,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_fact_flow.py:650"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_fact_flow.py","line":679,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_fact_flow.py:679"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_idle_wait.py","line":15,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_idle_wait.py:15"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_mem_proofs.py","line":70,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_mem_proofs.py:70"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_mem_proofs.py","line":70,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_mem_proofs.py:70"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_mem_proofs.py","line":74,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_mem_proofs.py:74"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_mem_proofs.py","line":74,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_mem_proofs.py:74"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_poll_continuations.py","line":287,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_poll_continuations.py:287"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_poll_continuations.py","line":306,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_poll_continuations.py:306"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_poll_continuations.py","line":346,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_poll_continuations.py:346"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_poll_continuations.py","line":346,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_poll_continuations.py:346"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_poll_continuations.py","line":349,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_poll_continuations.py:349"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_guest_poll_continuations.py","line":349,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_guest_poll_continuations.py:349"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_psq_pairs.py","line":43,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_psq_pairs.py:43"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_region_poll.py","line":130,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_region_poll.py:130"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_region_trace.py","line":87,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_region_trace.py:87"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_guest_region_trace.py","line":89,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_guest_region_trace.py:89"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_heavy_scene.py","line":132,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_heavy_scene.py:132"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_heavy_scene.py","line":132,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_heavy_scene.py:132"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_heavy_scene.py","line":136,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_heavy_scene.py:136"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_hot_pgo.py","line":45,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_hot_pgo.py:45"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_hot_region.py","line":252,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_hot_region.py:252"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_hot_region.py","line":258,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_hot_region.py:258"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_hud_render.py","line":52,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_hud_render.py:52"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_hud_stats.py","line":69,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_hud_stats.py:69"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_index_tuple_decode.py","line":67,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_index_tuple_decode.py:67"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_indirect_call_cache.py","line":126,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_indirect_call_cache.py:126"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_indirect_call_cache.py","line":126,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_indirect_call_cache.py:126"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_inline_gather_mmio.py","line":44,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_inline_gather_mmio.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_input_devices.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_input_devices.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_input_devices.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_input_devices.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_input_devices.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_input_devices.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_ipc_irq.py","line":60,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_ipc_irq.py:60"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_live_prompts.py","line":44,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_live_prompts.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_live_prompts.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_live_prompts.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_live_prompts.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_live_prompts.py:51"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_live_prompts.py","line":53,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_live_prompts.py:53"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_live_prompts.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_live_prompts.py:54"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_live_prompts.py","line":56,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_live_prompts.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_live_prompts.py","line":58,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_live_prompts.py:58"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_llvm_hybrid.py","line":35,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_llvm_hybrid.py:35"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_llvm_slice.py","line":61,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_llvm_slice.py:61"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_native_bulk_helpers.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_native_bulk_helpers.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_native_lowering.py","line":396,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_native_lowering.py:396"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_native_lowering.py","line":399,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_native_lowering.py:399"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_packed_layout.py","line":45,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_packed_layout.py:45"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_packed_upload.py","line":43,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_packed_upload.py:43"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_pe_interrupts.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_pe_interrupts.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_persistent_upload.py","line":100,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_persistent_upload.py:100"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_poll_periodic_check.py","line":75,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_poll_periodic_check.py:75"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_poll_reload_elision.py","line":211,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_poll_reload_elision.py:211"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_program_binary_cache.py","line":94,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_program_binary_cache.py:94"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_prompt_slots.py","line":9,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_prompt_slots.py:9"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_prompt_slots.py","line":10,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_prompt_slots.py:10"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_prompt_slots.py","line":10,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_prompt_slots.py:10"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_protected_fastmem.py","line":86,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_protected_fastmem.py:86"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_protected_fastmem.py","line":86,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_protected_fastmem.py:86"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_protected_fastmem.py","line":88,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_protected_fastmem.py:88"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_region_ssa.py","line":179,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_region_ssa.py:179"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_region_ssa.py","line":181,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_region_ssa.py:181"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_pacing.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_pacing.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_render_pacing.py","line":20,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_render_pacing.py:20"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_pacing.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_pacing.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_render_pacing.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_render_pacing.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_pacing.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_pacing.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_render_pacing.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_render_pacing.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_pacing.py","line":45,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_pacing.py:45"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_render_pacing.py","line":45,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_render_pacing.py:45"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_pacing.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_pacing.py:51"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_render_pacing.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_render_pacing.py:51"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_queue.py","line":56,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_queue.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_queue.py","line":61,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_queue.py:61"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_queue.py","line":76,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_queue.py:76"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_queue.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_queue.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_queue.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_queue.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_render_queue.py","line":135,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_render_queue.py:135"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_render_queue.py","line":135,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_render_queue.py:135"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_renderer_state_split.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_renderer_state_split.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_renderer_state_split.py","line":118,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_renderer_state_split.py:118"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_renderer_state_split.py","line":118,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_renderer_state_split.py:118"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_renderer_state_split.py","line":119,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_renderer_state_split.py:119"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_renderer_state_split.py","line":119,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_renderer_state_split.py:119"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_renderer_state_split.py","line":120,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_renderer_state_split.py:120"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_renderer_state_split.py","line":120,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_renderer_state_split.py:120"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_retained_gpu.py","line":87,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_retained_gpu.py:87"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_return_cache.py","line":85,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_return_cache.py:85"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_runtime_diagnostic_cache.py","line":33,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_runtime_diagnostic_cache.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_runtime_diagnostic_cache.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_runtime_diagnostic_cache.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_runtime_repairs.py","line":11,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_runtime_repairs.py:11"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_sampler_mode_cache.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_sampler_mode_cache.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_scalar_fp_lanes.py","line":12,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_scalar_fp_lanes.py:12"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_sched_recorder_opt_in.py","line":52,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_sched_recorder_opt_in.py:52"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_sched_recorder_opt_in.py","line":58,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_sched_recorder_opt_in.py:58"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_sdk_sqrt.py","line":65,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_sdk_sqrt.py:65"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_shader_cache_io.py","line":23,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_shader_cache_io.py:23"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_shader_data_uniforms.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_shader_data_uniforms.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_shader_preload.py","line":88,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_shader_preload.py:88"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_shader_source_reuse.py","line":60,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_shader_source_reuse.py:60"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_stutter_watch.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_stutter_watch.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_attribution.py","line":38,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_attribution.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_attribution.py","line":49,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_attribution.py:49"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_attribution.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_attribution.py:51"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_cpu_gl_split.py","line":78,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_cpu_gl_split.py:78"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_cpu_gl_split.py","line":182,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_cpu_gl_split.py:182"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_texture_cpu_gl_split.py","line":182,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_texture_cpu_gl_split.py:182"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_decode_fast.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_decode_fast.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_decode_fast.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_decode_fast.py:51"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_decode_fast.py","line":57,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_decode_fast.py:57"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_decode_fast.py","line":59,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_decode_fast.py:59"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_decode_fast.py","line":61,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_decode_fast.py:61"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_hash_cache.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_hash_cache.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation_memo.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation_memo.py:46"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation_memo.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation_memo.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation_memo.py","line":65,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation_memo.py:65"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation_memo.py","line":70,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation_memo.py:70"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation_memo.py","line":79,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation_memo.py:79"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation_memo.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation_memo.py:81"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_texture_validation_memo.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_texture_validation_memo.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_tracker_host_writes.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_tracker_host_writes.py:51"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_tracker_host_writes.py","line":72,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_tracker_host_writes.py:72"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_tracker_host_writes.py","line":76,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_tracker_host_writes.py:76"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_tracker_host_writes.py","line":78,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_tracker_host_writes.py:78"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_tracker_host_writes.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_tracker_host_writes.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_used_texture_binding.py","line":71,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_used_texture_binding.py:71"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_v13_runtime.py","line":66,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_v13_runtime.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_v13_runtime.py","line":67,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_v13_runtime.py:67"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_vertex_emit_kernel.py","line":652,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_vertex_emit_kernel.py:652"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/check_vertex_emit_kernel.py","line":652,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/check_vertex_emit_kernel.py:652"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_vertex_reuse.py","line":150,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_vertex_reuse.py:150"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_watch_fold.py","line":189,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_watch_fold.py:189"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_watch_fold.py","line":191,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_watch_fold.py:191"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_watch_fold.py","line":202,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_watch_fold.py:202"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/check_watch_span_guards.py","line":29,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/check_watch_span_guards.py:29"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/clean_room_build.py","line":222,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/clean_room_build.py:222"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/fix_dsp_ax.py","line":5,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/fix_dsp_ax.py:5"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/fix_gap_functions.py","line":65,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/fix_gap_functions.py:65"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/fix_gap_functions.py","line":65,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/fix_gap_functions.py:65"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/fix_guest_arena.py","line":522,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/fix_guest_arena.py:522"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/fix_guest_arena.py","line":522,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/fix_guest_arena.py:522"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/fix_llvm_ir_backend.py","line":139,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/fix_llvm_ir_backend.py:139"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/guest_region_trace.py","line":139,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/guest_region_trace.py:139"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/llvm_slice/count_insns.py","line":8,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/llvm_slice/count_insns.py:8"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/pgo_train.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/pgo_train.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/pgo_train.py","line":91,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/pgo_train.py:91"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/pgo_train.py","line":93,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/pgo_train.py:93"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/pgo_train.py","line":93,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/pgo_train.py:93"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/probe_guest_psq_pairs.py","line":66,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/probe_guest_psq_pairs.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/reference.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/reference.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'list2cmdline' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/reference.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/reference.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/reference.py","line":66,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/reference.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/reference.py","line":66,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/reference.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/run_guest_pass_checks.py","line":49,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/run_guest_pass_checks.py:49"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/run_guest_pass_checks.py","line":55,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/run_guest_pass_checks.py:55"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"tools/run_startup.py","line":98,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:tools/run_startup.py:98"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"tools/run_startup.py","line":98,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:tools/run_startup.py:98"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":125,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:125"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":126,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:126"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":128,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:128"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":163,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:launcher/ui/app.js:163"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"launcher/ui/app.js","line":442,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:launcher/ui/app.js:442"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":562,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:562"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":564,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:564"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":565,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:565"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":609,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:609"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":628,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:628"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":632,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:632"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":668,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:668"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":668,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:668"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":669,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:669"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":671,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:671"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":671,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:671"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":690,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:690"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":691,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:691"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":692,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:692"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":740,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:740"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":741,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:741"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":744,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:744"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":745,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:745"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":754,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:754"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":758,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:758"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":759,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:759"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":761,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:761"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":762,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:762"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":932,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:932"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":933,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:933"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":933,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:933"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":934,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:934"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"launcher/ui/app.js","line":935,"fingerprint":"javascript.lang.security.html-in-template-string:launcher/ui/app.js:935"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"reference/dolphin-ax/AX.h","line":152,"fingerprint":"c.lang.security.insecure-use-memset:reference/dolphin-ax/AX.h:152"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"runtime-overlays/native_ax/base.h","line":87,"fingerprint":"c.lang.security.insecure-use-memset:runtime-overlays/native_ax/base.h:87"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"tools/fix_direct_fifo.py","line":185,"fingerprint":"python.lang.security.audit.regex_dos:tools/fix_direct_fifo.py:185"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"tools/fix_guest_arena.py","line":47,"fingerprint":"python.lang.security.audit.regex_dos:tools/fix_guest_arena.py:47"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"tools/fix_hot_region.py","line":142,"fingerprint":"python.lang.security.audit.regex_dos:tools/fix_hot_region.py:142"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"tools/fix_poll_reload_elision.py","line":56,"fingerprint":"python.lang.security.audit.regex_dos:tools/fix_poll_reload_elision.py:56"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"tools/fix_v13_runtime.py","line":23,"fingerprint":"python.lang.security.audit.regex_dos:tools/fix_v13_runtime.py:23"}],"evidence":[],"data":{"rulesets":["python","c","rust","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":13.0,"vulnerabilities":32.0,"vulns_critical":2.0,"vulns_high":2.0,"vulns_medium":3.0,"vulns_low":3.0,"vulns_unknown":22.0,"penalty":51.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0369","severity":"critical","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0369","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):RUSTSEC-2026-0369"},{"rule_id":"osv/GHSA-m665-v7pm-7grj","severity":"critical","message":"zip@2.4.2 (crates.io) is affected by GHSA-m665-v7pm-7grj","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):GHSA-m665-v7pm-7grj"},{"rule_id":"osv/RUSTSEC-2026-0367","severity":"high","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0367","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):RUSTSEC-2026-0367"},{"rule_id":"osv/GHSA-q7v9-x93c-xqv3","severity":"high","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):GHSA-q7v9-x93c-xqv3"},{"rule_id":"osv/GHSA-wrw7-89jp-8q8g","severity":"medium","message":"glib@0.18.5 (crates.io) is affected by RUSTSEC-2024-0429, GHSA-wrw7-89jp-8q8g","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"glib@0.18.5 (crates.io):GHSA-wrw7-89jp-8q8g"},{"rule_id":"osv/RUSTSEC-2026-0418","severity":"medium","message":"libz-sys@1.1.29 (crates.io) is affected by RUSTSEC-2026-0418","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"libz-sys@1.1.29 (crates.io):RUSTSEC-2026-0418"},{"rule_id":"osv/RUSTSEC-2026-0253","severity":"medium","message":"lru@0.16.4 (crates.io) is affected by RUSTSEC-2026-0253","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"lru@0.16.4 (crates.io):RUSTSEC-2026-0253"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2024-0370","severity":"medium","message":"proc-macro-error@1.0.4 (crates.io) is affected by RUSTSEC-2024-0370","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"proc-macro-error@1.0.4 (crates.io):RUSTSEC-2024-0370"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.45 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"rustls@0.23.45 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.15 (crates.io) is affected by RUSTSEC-2026-0382","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.15 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.53.2 (crates.io) is affected by RUSTSEC-2026-0386","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"tokio@1.53.2 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0383","severity":"medium","message":"webpki-root-certs@1.0.9 (crates.io) is affected by RUSTSEC-2026-0383","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"webpki-root-certs@1.0.9 (crates.io):RUSTSEC-2026-0383"},{"rule_id":"osv/RUSTSEC-2026-0368","severity":"medium","message":"zip@2.4.2 (crates.io) is affected by RUSTSEC-2026-0368","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):RUSTSEC-2026-0368"},{"rule_id":"osv/GHSA-8hxf-qr8p-62x4","severity":"medium","message":"zip@2.4.2 (crates.io) is affected by GHSA-8hxf-qr8p-62x4","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zip@2.4.2 (crates.io):GHSA-8hxf-qr8p-62x4"},{"rule_id":"osv/RUSTSEC-2026-0391","severity":"medium","message":"zstd@0.13.3 (crates.io) is affected by RUSTSEC-2026-0391","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd@0.13.3 (crates.io):RUSTSEC-2026-0391"},{"rule_id":"osv/RUSTSEC-2026-0395","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0395","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0395"},{"rule_id":"osv/RUSTSEC-2026-0396","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0396","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0396"},{"rule_id":"osv/RUSTSEC-2026-0397","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0397","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0397"},{"rule_id":"osv/RUSTSEC-2026-0398","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0398","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0398"},{"rule_id":"osv/RUSTSEC-2026-0399","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0399","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0399"},{"rule_id":"osv/RUSTSEC-2026-0400","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0400","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0400"},{"rule_id":"osv/RUSTSEC-2026-0401","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0401","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0401"},{"rule_id":"osv/RUSTSEC-2026-0402","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0402","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0402"},{"rule_id":"osv/RUSTSEC-2026-0403","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0403","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0403"},{"rule_id":"osv/RUSTSEC-2026-0404","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0404","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0404"},{"rule_id":"osv/RUSTSEC-2026-0405","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0405","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0405"},{"rule_id":"osv/RUSTSEC-2026-0406","severity":"medium","message":"zstd-safe@7.3.0 (crates.io) is affected by RUSTSEC-2026-0406","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-safe@7.3.0 (crates.io):RUSTSEC-2026-0406"},{"rule_id":"osv/RUSTSEC-2026-0410","severity":"medium","message":"zstd-sys@2.1.0+zstd.1.5.7 (crates.io) is affected by RUSTSEC-2026-0410","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"zstd-sys@2.1.0+zstd.1.5.7 (crates.io):RUSTSEC-2026-0410"},{"rule_id":"osv/GHSA-vp88-798v-h67f","severity":"low","message":"rustls@0.23.45 (crates.io) is affected by RUSTSEC-2026-0347, GHSA-vp88-798v-h67f","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"rustls@0.23.45 (crates.io):GHSA-vp88-798v-h67f"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.45 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"rustls@0.23.45 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.45 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"launcher/src-tauri/Cargo.lock","line":null,"fingerprint":"rustls@0.23.45 (crates.io):GHSA-w44r-93j7-qv28"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":15.0,"findings_high":11.0,"findings_medium":3.0,"findings_low":1.0,"penalty":128.4},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/checks.yml","line":14,"fingerprint":"unpinned-uses:.github/workflows/checks.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/checks.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/checks.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/checks.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/checks.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/checks.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/checks.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/release.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/release.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":64,"fingerprint":"unpinned-uses:.github/workflows/release.yml:64"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":66,"fingerprint":"unpinned-uses:.github/workflows/release.yml:66"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":131,"fingerprint":"unpinned-uses:.github/workflows/release.yml:131"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":138,"fingerprint":"unpinned-uses:.github/workflows/release.yml:138"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":66,"fingerprint":"cache-poisoning:.github/workflows/release.yml:66"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/checks.yml","line":14,"fingerprint":"artipacked:.github/workflows/checks.yml:14"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/checks.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/checks.yml:10"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":26,"fingerprint":"artipacked:.github/workflows/release.yml:26"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":138,"fingerprint":"superfluous-actions:.github/workflows/release.yml:138"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0625,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":10.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.1.9 ships CrashLauncher-0.1.9-windows-x64-setup.exe (115 downloads)","ref":"CrashLauncher-0.1.9-windows-x64-setup.exe","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.9/CrashLauncher-0.1.9-windows-x64-setup.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v0.1.8 ships CrashLauncher-0.1.8-windows-x64-setup.exe (193 downloads)","ref":"CrashLauncher-0.1.8-windows-x64-setup.exe","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.8/CrashLauncher-0.1.8-windows-x64-setup.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v0.1.7 ships CrashLauncher-0.1.7-windows-x64-setup.exe (21 downloads)","ref":"CrashLauncher-0.1.7-windows-x64-setup.exe","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.7/CrashLauncher-0.1.7-windows-x64-setup.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v0.1.6 ships CrashLauncher-0.1.6-windows-x64-setup.exe (13 downloads)","ref":"CrashLauncher-0.1.6-windows-x64-setup.exe","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.6/CrashLauncher-0.1.6-windows-x64-setup.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v0.1.5 ships CrashLauncher-0.1.5-windows-x64-setup.exe (18 downloads)","ref":"CrashLauncher-0.1.5-windows-x64-setup.exe","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/releases/download/v0.1.5/CrashLauncher-0.1.5-windows-x64-setup.exe","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":3374.0,"function_nloc":44213.0,"mean_ccn":4.87,"p90_ccn":11.0,"complex_functions":199.0,"long_functions":41.0,"many_param_functions":13.0,"risky_nloc_share":0.3476},"findings":[],"evidence":[{"kind":"complex-function","description":"func_803A2CC8 in tools/native_lower_vector_tests.cpp: complexity 180, 620 lines","ref":"tools/native_lower_vector_tests.cpp","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/native_lower_vector_tests.cpp#L348","weight":1.0},{"kind":"complex-function","description":"translated_8028199C in tools/native_lower_inferred_tests.cpp: complexity 113, 300 lines","ref":"tools/native_lower_inferred_tests.cpp","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/native_lower_inferred_tests.cpp#L330","weight":1.0},{"kind":"complex-function","description":"effects in tools/ppc_effects.py: complexity 109, 173 lines","ref":"tools/ppc_effects.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/ppc_effects.py#L41","weight":1.0},{"kind":"complex-function","description":"_promote in tools/promote_regs.py: complexity 107, 244 lines","ref":"tools/promote_regs.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/promote_regs.py#L412","weight":1.0},{"kind":"complex-function","description":"main in tools/fix_hot_split.py: complexity 87, 174 lines","ref":"tools/fix_hot_split.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/fix_hot_split.py#L83","weight":1.0},{"kind":"complex-function","description":"translated_802880E8 in tools/native_lower_inferred_tests.cpp: complexity 86, 234 lines","ref":"tools/native_lower_inferred_tests.cpp","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/native_lower_inferred_tests.cpp#L49","weight":1.0},{"kind":"complex-function","description":"main in tools/native_lower_gx_tests.cpp: complexity 76, 664 lines","ref":"tools/native_lower_gx_tests.cpp","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/native_lower_gx_tests.cpp#L406","weight":1.0},{"kind":"complex-function","description":"_classify in compiler/lift_guest_cpp.py: complexity 71, 117 lines","ref":"compiler/lift_guest_cpp.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/compiler/lift_guest_cpp.py#L324","weight":1.0},{"kind":"complex-function","description":"analyze in tools/analyze_frame_trace.py: complexity 67, 79 lines","ref":"tools/analyze_frame_trace.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/analyze_frame_trace.py#L8","weight":1.0},{"kind":"complex-function","description":"apply in tools/guest_loop_guards.py: complexity 67, 88 lines","ref":"tools/guest_loop_guards.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/tools/guest_loop_guards.py#L10","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":73956.0,"duplicated_lines":4598.0,"duplicated_share":0.0622,"files":665.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: compiler/emit_llvm_ir.py:119 and compiler/emit_llvm_module.py:179","ref":"compiler/emit_llvm_ir.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/compiler/emit_llvm_ir.py#L119","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: compiler/emit_llvm_module.py:484 and compiler/emit_llvm_module.py:701","ref":"compiler/emit_llvm_module.py","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/compiler/emit_llvm_module.py#L484","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: launcher/src-tauri/src/direct.rs:255 and launcher/src-tauri/src/prompts.rs:281","ref":"launcher/src-tauri/src/direct.rs","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/launcher/src-tauri/src/direct.rs#L255","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reference/dolphin-ax/AX.cpp:128 and reference/dolphin-ax/AXWii.cpp:160","ref":"reference/dolphin-ax/AX.cpp","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AX.cpp#L128","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reference/dolphin-ax/AX.cpp:563 and runtime-overlays/native_ax/base.h:130","ref":"reference/dolphin-ax/AX.cpp","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AX.cpp#L563","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reference/dolphin-ax/AX.h:39 and runtime-overlays/native_ax/base.h:3","ref":"reference/dolphin-ax/AX.h","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AX.h#L39","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reference/dolphin-ax/AXStructs.h:1 and runtime-overlays/native_ax/structs.h:1","ref":"reference/dolphin-ax/AXStructs.h","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AXStructs.h#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reference/dolphin-ax/AXVoice.h:1 and runtime-overlays/native_ax/voice.h:1","ref":"reference/dolphin-ax/AXVoice.h","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AXVoice.h#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reference/dolphin-ax/AXVoice.h:231 and reference/dolphin-ax/AXVoice.h:271","ref":"reference/dolphin-ax/AXVoice.h","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AXVoice.h#L231","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reference/dolphin-ax/AXWii.cpp:107 and reference/dolphin-ax/AXWii.cpp:204","ref":"reference/dolphin-ax/AXWii.cpp","url":"https://github.com/jaylikesbunda/CrashoftheTitans-Wiicomp/blob/25c8358fd1fd0a5bc9ae442c11e79ab8559a3db8/reference/dolphin-ax/AXWii.cpp#L107","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":70.0,"weighted_findings":79.25,"scanned_lines":88915.0,"category:best-practice":13.0,"category:correctness":35.0,"category:maintainability":22.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"tools/capture_guest_execution_region.py","line":135,"fingerprint":"python.lang.best-practice.arbitrary-sleep:tools/capture_guest_execution_region.py:135"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"tools/clean_room_build.py","line":207,"fingerprint":"python.lang.best-practice.arbitrary-sleep:tools/clean_room_build.py:207"},{"rule_id":"opengrep/python.lang.correctness.no-strings-as-booleans","severity":"high","message":"Using strings as booleans in Python has unexpected results. `\"one\" and \"two\"` will return \"two\". `\"one\" or \"two\"` will return \"one\". In Python, strings are truthy, and strings with a non-zero length evaluate to True.","path":"tools/fix_chunk_size_flags.py","line":26,"fingerprint":"python.lang.correctness.no-strings-as-booleans:tools/fix_chunk_size_flags.py:26"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"tools/pgo_train.py","line":47,"fingerprint":"python.lang.best-practice.arbitrary-sleep:tools/pgo_train.py:47"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"tools/pgo_train.py","line":54,"fingerprint":"python.lang.best-practice.arbitrary-sleep:tools/pgo_train.py:54"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"launcher/ui/app.js","line":530,"fingerprint":"javascript.lang.best-practice.javascript-confirm:launcher/ui/app.js:530"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"launcher/ui/app.js","line":950,"fingerprint":"javascript.lang.best-practice.javascript-confirm:launcher/ui/app.js:950"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/check_dispatch_switch.py","line":30,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/check_dispatch_switch.py:30"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/check_guest_arena.py","line":301,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/check_guest_arena.py:301"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/check_guest_poll_continuations.py","line":266,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/check_guest_poll_continuations.py:266"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/check_guest_poll_continuations.py","line":273,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/check_guest_poll_continuations.py:273"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/check_guest_poll_continuations.py","line":279,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/check_guest_poll_continuations.py:279"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/check_sdk_sqrt.py","line":26,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/check_sdk_sqrt.py:26"},{"rule_id":"opengrep/python.lang.best-practice.pass-body-range","severity":"medium","message":"`pass` is the body of for name, tag in (('GX_WGPIPE_Write8(uint8_t)', 8), ('GX_WGPIPE_Write16(uint16_t)', 16), ('GX_WGPIPE_Write32(uint32_t)', 32),\r\n                      ('GX_WGPIPE_WriteF32(float)', 33), ('GX_WGPIPE_WriteF64(double)', 64)). Consider removing this or raise NotImplementedError() if ","path":"tools/check_watch_fold.py","line":27,"fingerprint":"python.lang.best-practice.pass-body-range:tools/check_watch_fold.py:27"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/clean_room_build.py","line":141,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/clean_room_build.py:141"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/derive_release_map.py","line":101,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/derive_release_map.py:101"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_andis_record.py","line":17,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_andis_record.py:17"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_audio_worker.py","line":36,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_audio_worker.py:36"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_audio_worker.py","line":39,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_audio_worker.py:39"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_audio_worker.py","line":43,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_audio_worker.py:43"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_bounded_blocks.py","line":64,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_bounded_blocks.py:64"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_dispatch_hot_path.py","line":19,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_dispatch_hot_path.py:19"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_dispatch_hot_path.py","line":25,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_dispatch_hot_path.py:25"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_dispatch_hot_path.py","line":30,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_dispatch_hot_path.py:30"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_dispatch_hot_path.py","line":33,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_dispatch_hot_path.py:33"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_divw_edge.py","line":24,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_divw_edge.py:24"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_divw_edge.py","line":25,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_divw_edge.py:25"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_event_mask.py","line":106,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_event_mask.py:106"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_event_mask.py","line":110,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_event_mask.py:110"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_gap_functions.py","line":79,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_gap_functions.py:79"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_gl_raster_shadow.py","line":25,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_gl_raster_shadow.py:25"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_gl_raster_shadow.py","line":31,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_gl_raster_shadow.py:31"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_guest_psq_pairs.py","line":14,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_guest_psq_pairs.py:14"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_guest_regions.py","line":51,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_guest_regions.py:51"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_gx_drain_cv.py","line":39,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_gx_drain_cv.py:39"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_gx_drain_cv.py","line":41,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_gx_drain_cv.py:41"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_gx_early_drain.py","line":45,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_gx_early_drain.py:45"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_hot_diag_gates.py","line":42,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_hot_diag_gates.py:42"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_hot_diag_gates.py","line":49,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_hot_diag_gates.py:49"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_hot_diag_gates.py","line":51,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_hot_diag_gates.py:51"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_ind_debug.py","line":43,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_ind_debug.py:43"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_input_mapping.py","line":32,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_input_mapping.py:32"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_input_mapping.py","line":34,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_input_mapping.py:34"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_input_mapping.py","line":38,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_input_mapping.py:38"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_input_mapping.py","line":40,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_input_mapping.py:40"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_misc_hot_paths.py","line":18,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_misc_hot_paths.py:18"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_misc_hot_paths.py","line":21,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_misc_hot_paths.py:21"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_misc_hot_paths.py","line":26,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_misc_hot_paths.py:26"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_misc_hot_paths.py","line":29,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_misc_hot_paths.py:29"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_misc_hot_paths.py","line":34,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_misc_hot_paths.py:34"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_misc_hot_paths.py","line":38,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_misc_hot_paths.py:38"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_misc_hot_paths.py","line":46,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_misc_hot_paths.py:46"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_mmio_lookup_cache.py","line":27,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_mmio_lookup_cache.py:27"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_poll_credit.py","line":76,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_poll_credit.py:76"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_sdk_sqrt_loops.py","line":25,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_sdk_sqrt_loops.py:25"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_stfiwx_bits.py","line":22,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_stfiwx_bits.py:22"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_texture_attribution.py","line":31,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_texture_attribution.py:31"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_texture_attribution.py","line":51,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_texture_attribution.py:51"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_texture_decode_fast.py","line":43,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_texture_decode_fast.py:43"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_texture_decode_fast.py","line":46,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_texture_decode_fast.py:46"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_texture_decode_fast.py","line":52,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_texture_decode_fast.py:52"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"tools/fix_texture_decode_fast.py","line":59,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:tools/fix_texture_decode_fast.py:59"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/fix_wpar_gather_redirect.py","line":128,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/fix_wpar_gather_redirect.py:128"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/guest_arena_tests/gen_decoder_variants.py","line":88,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/guest_arena_tests/gen_decoder_variants.py:88"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/guest_arena_tests/gen_decoder_variants.py","line":89,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/guest_arena_tests/gen_decoder_variants.py:89"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/guest_arena_tests/gen_stubs.py","line":5,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/guest_arena_tests/gen_stubs.py:5"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/guest_arena_tests/gen_stubs.py","line":9,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/guest_arena_tests/gen_stubs.py:9"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/make_builder_pack.py","line":45,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/make_builder_pack.py:45"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"tools/make_builder_pack.py","line":87,"fingerprint":"python.lang.maintainability.return-not-in-function:tools/make_builder_pack.py:87"},{"rule_id":"opengrep/python.lang.maintainability.useless-assignment-keyed","severity":"low","message":"key `'wpad'` in `coop` is assigned twice; the first assignment is useless","path":"tools/check_live_prompts.py","line":15,"fingerprint":"python.lang.maintainability.useless-assignment-keyed:tools/check_live_prompts.py:15"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":88921.0,"test_ratio":0.0,"ci_files":2.0,"cochange_share":0.0,"cochange_commits":17.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/checks.yml","ref":".github/workflows/checks.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test, cargo test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test","cargo test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":89.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":5.0,"escapes_per_kloc":0.095},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}