{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:05.622074Z","repo":{"ref":{"host":"github.com","owner":"joonanykanen","name":"react-tetris"},"default_branch":"main","clone_url":"https://github.com/joonanykanen/react-tetris.git","html_url":"https://github.com/joonanykanen/react-tetris","description":"A fully-featured Tetris game built with React 19, TypeScript, Jotai, and Tailwind CSS.","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":8684,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2025-12-23T18:16:53Z","pushed_at":"2026-01-17T19:34:12Z","security_policy_url":null,"distribution":{"owner_created_at":"2022-08-11T07:57:44Z","owner_type":"User","release_assets":[]}},"commit_sha":"0bab10e8e4813489b623ac5b8b5689b790d4a8ee","profile":{"lines_by_language":{"TypeScript":2731,"JavaScript":23},"files_by_category":{"source":33,"config":6,"other":5,"docs":2,"oversized":2,"generated":1},"source_lines":2754,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.45,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.726},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":59.9,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":76.9,"duplication":55.4,"lint":100.0,"testing":15.0,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 9% of function code in complex or long functions; 10% duplicated lines. Weakest area: testing."},"security":{"score":59.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":100.0,"dependencies":11.5,"ci_actions":30.0,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 57 known vulnerabilities in 19 dependencies; 6 high-severity workflow issues. Weakest area: dependencies."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":18.0,"checked":18.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":19.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":2933.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2025-12":{"loc":2629,"attributed_loc":0},"2026-01":{"loc":304,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":13.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2933.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":277.19528178243775,"median_loc_per_hour":105.46932661088846,"pr_timed_units":10.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2754.0,"index":0.726,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":4.0,"per_kloc:emoji_in_code":1.452,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":2754.0,"parse_errors":0.0},"findings":[],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":19.0,"vulnerabilities":57.0,"vulns_critical":0.0,"vulns_high":36.0,"vulns_medium":19.0,"vulns_low":2.0,"vulns_unknown":0.0,"penalty":130.0},"findings":[{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"pnpm-lock.yaml","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"pnpm-lock.yaml","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-25h7-pfq9-p65f","path":"pnpm-lock.yaml","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"pnpm-lock.yaml","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.3 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-6g55-p6wh-862q","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-r28c-9q8g-f849","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-mw96-cpmx-2vgc","severity":"high","message":"rollup@4.53.5 (npm) is affected by GHSA-mw96-cpmx-2vgc","path":"pnpm-lock.yaml","line":null,"fingerprint":"rollup@4.53.5 (npm):GHSA-mw96-cpmx-2vgc"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"pnpm-lock.yaml","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@7.3.0 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-p9ff-h696-f583","severity":"high","message":"vite@7.3.0 (npm) is affected by GHSA-p9ff-h696-f583","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-p9ff-h696-f583"},{"rule_id":"osv/GHSA-v2wj-q39q-566r","severity":"high","message":"vite@7.3.0 (npm) is affected by GHSA-v2wj-q39q-566r","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-v2wj-q39q-566r"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.2.1 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"pnpm-lock.yaml","line":null,"fingerprint":"zod@4.2.1 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.7 (npm) is affected by GHSA-p498-v437-472g","path":"pnpm-lock.yaml","line":null,"fingerprint":"@humanfs/node@0.16.7 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"pnpm-lock.yaml","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.9.11 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"pnpm-lock.yaml","line":null,"fingerprint":"baseline-browser-mapping@2.9.11 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"pnpm-lock.yaml","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.1 (npm) is affected by GHSA-h67p-54hq-rp68","path":"pnpm-lock.yaml","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.3 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"pnpm-lock.yaml","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@7.3.0 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.28.5 (npm) is affected by GHSA-4x5r-pxfx-6jf8","path":"pnpm-lock.yaml","line":null,"fingerprint":"@babel/core@7.28.5 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@7.3.0 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@7.3.0 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":7.0,"findings_high":6.0,"findings_medium":0.0,"findings_low":1.0,"penalty":72.3},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":44,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:47"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":53,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:53"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/deploy.yml","line":23,"fingerprint":"artipacked:.github/workflows/deploy.yml:23"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.5263,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":147.0,"function_nloc":1542.0,"mean_ccn":2.47,"p90_ccn":5.0,"complex_functions":2.0,"long_functions":1.0,"many_param_functions":0.0,"risky_nloc_share":0.0875},"findings":[],"evidence":[{"kind":"complex-function","description":"(anonymous) in src/App.tsx: complexity 16, 26 lines","ref":"src/App.tsx","url":"https://github.com/joonanykanen/react-tetris/blob/0bab10e8e4813489b623ac5b8b5689b790d4a8ee/src/App.tsx#L56","weight":0.26666666666666666},{"kind":"complex-function","description":"Leaderboard in src/components/Leaderboard.tsx: complexity 16, 109 lines","ref":"src/components/Leaderboard.tsx","url":"https://github.com/joonanykanen/react-tetris/blob/0bab10e8e4813489b623ac5b8b5689b790d4a8ee/src/components/Leaderboard.tsx#L18","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1847.0,"duplicated_lines":182.0,"duplicated_share":0.0985,"files":33.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/atoms/gameActionsAtom.ts:34 and src/atoms/gameActionsAtom.ts:217","ref":"src/atoms/gameActionsAtom.ts","url":"https://github.com/joonanykanen/react-tetris/blob/0bab10e8e4813489b623ac5b8b5689b790d4a8ee/src/atoms/gameActionsAtom.ts#L34","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/components/SettingsButton.tsx:18 and src/components/SoundToggle.tsx:27","ref":"src/components/SettingsButton.tsx","url":"https://github.com/joonanykanen/react-tetris/blob/0bab10e8e4813489b623ac5b8b5689b790d4a8ee/src/components/SettingsButton.tsx#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/components/SettingsModal.tsx:113 and src/components/SettingsModal.tsx:131","ref":"src/components/SettingsModal.tsx","url":"https://github.com/joonanykanen/react-tetris/blob/0bab10e8e4813489b623ac5b8b5689b790d4a8ee/src/components/SettingsModal.tsx#L113","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/utils/movement.ts:59 and src/utils/movement.ts:90","ref":"src/utils/movement.ts","url":"https://github.com/joonanykanen/react-tetris/blob/0bab10e8e4813489b623ac5b8b5689b790d4a8ee/src/utils/movement.ts#L59","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/utils/sound.ts:60 and src/utils/sound.ts:191","ref":"src/utils/sound.ts","url":"https://github.com/joonanykanen/react-tetris/blob/0bab10e8e4813489b623ac5b8b5689b790d4a8ee/src/utils/sound.ts#L60","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":2754.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":2754.0,"test_ratio":0.0,"ci_files":1.0,"cochange_share":0.0,"cochange_commits":14.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/deploy.yml","ref":".github/workflows/deploy.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":195.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE.md","ref":"LICENSE.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":3.0,"escapes_per_kloc":1.098},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.app.json","ref":"tsconfig.app.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}