{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:55:58.053180Z","repo":{"ref":{"host":"github.com","owner":"lucaperl","name":"paperless-local-ai"},"default_branch":"main","clone_url":"https://github.com/lucaperl/paperless-local-ai.git","html_url":"https://github.com/lucaperl/paperless-local-ai","description":"Local OCR, metadata automation and RAG document chat for Paperless-ngx using PaddleOCR and Ollama, designed for CPU-only self-hosted servers","stars":22,"forks":2,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2100,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-08-18T20:21:22Z","pushed_at":"2026-11-01T12:19:04Z","security_policy_url":"https://github.com/lucaperl/paperless-local-ai/security/policy","distribution":{"owner_created_at":"2019-07-12T20:51:18Z","owner_type":"User","release_assets":[]}},"commit_sha":"716044b35b7ed6208a1eaffcaf2dd78d15ef3744","profile":{"lines_by_language":{"Python":13996,"Rust":10084,"JavaScript":1903},"files_by_category":{"source":57,"docs":27,"config":20,"test":18,"other":7,"binary":4,"generated":1},"source_lines":22779,"test_lines":3204},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.2698,"estimated_share":0.0,"ai_artifacts":1.0,"flagged_work_units":2.0,"flagged_releases":1.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":69.7,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":46.7,"duplication":72.0,"lint":80.5,"testing":82.0,"docs":100.0,"type_safety":0.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.14, CI runs tests; 25% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety."},"security":{"score":73.2,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":89.7,"dependencies":64.8,"ci_actions":0.1,"posture":100.0,"scorecard":null},"summary":"Security posture is adequate: 14 known vulnerabilities in 7 dependencies; 4 high-severity SAST findings; 37 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":10.0,"checked":10.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":111.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":34301.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-08":{"loc":26898,"attributed_loc":0},"2026-09":{"loc":7392,"attributed_loc":0},"2026-10":{"loc":11,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1787084650.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1787084650}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":40.0,"flagged_units":2.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":28914.0,"flagged_loc":9256.0,"flagged_loc_share":0.3201217403334025,"max_loc_per_hour":1682.0,"median_loc_per_hour":132.43567502079776,"pr_timed_units":28.0,"excluded_import_loc":5387.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"6,513 lines of first-party code in ~4.0h (1,616 lines/hour, PR #62)","ref":"0edcb2923c025060cce58fbb4764f3dc2a815b42","url":"https://github.com/lucaperl/paperless-local-ai/commit/0edcb2923c025060cce58fbb4764f3dc2a815b42","weight":0.48467167367188047},{"kind":"velocity-burst","description":"2,743 lines of first-party code in ~4.0h (686 lines/hour, 1 commit session)","ref":"b35152ae89f41784524be46814b98df29cd0431e","url":"https://github.com/lucaperl/paperless-local-ai/commit/b35152ae89f41784524be46814b98df29cd0431e","weight":0.205725}],"data":{"flagged_loc_by_commit":{"b35152ae89f41784524be46814b98df29cd0431e":2743,"0edcb2923c025060cce58fbb4764f3dc2a815b42":6513},"excluded_import_commits":["459b09435698c368f9dbe786a41a82eadde9b146"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":30.0,"flagged_releases":1.0,"max_loc_per_day":14046.3},"findings":[],"evidence":[{"kind":"release-burst","description":"v0.3.4 → v0.3.5-rc.1: 6,513 lines in 0.46 days (14,046.3 lines/day)","ref":"v0.3.4...v0.3.5-rc.1","url":"https://github.com/lucaperl/paperless-local-ai/compare/v0.3.4...v0.3.5-rc.1","weight":0.4}],"data":{"releases":[{"from":"v0.1.0","to":"v0.1.1","loc":203,"days":0.06,"loc_per_day":3226.5,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":905,"days":0.58,"loc_per_day":1558.1,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":328,"days":0.15,"loc_per_day":2250.6,"flagged":false},{"from":"v0.1.3","to":"v0.2.0","loc":1247,"days":1.73,"loc_per_day":719.8,"flagged":false},{"from":"v0.2.0","to":"v0.2.1","loc":392,"days":0.17,"loc_per_day":2365.5,"flagged":false},{"from":"v0.2.1","to":"v0.2.2","loc":175,"days":0.31,"loc_per_day":560.4,"flagged":false},{"from":"v0.2.2","to":"v0.2.3","loc":2743,"days":0.58,"loc_per_day":4747.2,"flagged":false},{"from":"v0.2.3","to":"v0.2.4","loc":265,"days":0.17,"loc_per_day":1518.7,"flagged":false},{"from":"v0.2.4","to":"v0.3.0","loc":1791,"days":1.29,"loc_per_day":1393.0,"flagged":false},{"from":"v0.3.0","to":"v0.3.1","loc":350,"days":0.52,"loc_per_day":667.3,"flagged":false},{"from":"v0.3.1","to":"v0.3.2","loc":31,"days":0.1,"loc_per_day":303.0,"flagged":false},{"from":"v0.3.2","to":"v0.3.3","loc":65,"days":0.12,"loc_per_day":548.6,"flagged":false},{"from":"v0.3.3","to":"v0.3.4-rc.1","loc":1445,"days":0.36,"loc_per_day":3973.1,"flagged":false},{"from":"v0.3.4-rc.1","to":"v0.3.4-rc.2","loc":281,"days":0.05,"loc_per_day":5203.3,"flagged":false},{"from":"v0.3.4-rc.2","to":"v0.3.4","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.3.4","to":"v0.3.5-rc.1","loc":6513,"days":0.46,"loc_per_day":14046.3,"flagged":true},{"from":"v0.3.5-rc.1","to":"v0.3.5-rc.2","loc":397,"days":0.11,"loc_per_day":3469.3,"flagged":false},{"from":"v0.3.5-rc.2","to":"v0.3.5-rc.3","loc":260,"days":0.09,"loc_per_day":2922.3,"flagged":false},{"from":"v0.3.5-rc.3","to":"v0.3.5-rc.4","loc":108,"days":0.04,"loc_per_day":2592.0,"flagged":false},{"from":"v0.3.5-rc.4","to":"v0.3.5-rc.5","loc":139,"days":0.04,"loc_per_day":3157.1,"flagged":false},{"from":"v0.3.5-rc.5","to":"v0.3.5-rc.6","loc":7,"days":0.04,"loc_per_day":168.0,"flagged":false},{"from":"v0.3.5-rc.6","to":"v0.3.5","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.3.5","to":"v0.3.6","loc":1402,"days":0.95,"loc_per_day":1481.6,"flagged":false},{"from":"v0.3.6","to":"v0.3.7","loc":243,"days":0.15,"loc_per_day":1669.1,"flagged":false},{"from":"v0.3.7","to":"v0.3.8","loc":1113,"days":1.48,"loc_per_day":751.9,"flagged":false},{"from":"v0.3.8","to":"v0.3.9","loc":999,"days":3.04,"loc_per_day":328.7,"flagged":false},{"from":"v0.3.9","to":"v0.4.0","loc":104,"days":0.04,"loc_per_day":2496.0,"flagged":false},{"from":"v0.4.0","to":"v0.5.0","loc":6634,"days":9.29,"loc_per_day":714.1,"flagged":false},{"from":"v0.5.0","to":"v0.5.1","loc":707,"days":9.64,"loc_per_day":73.4,"flagged":false},{"from":"v0.5.1","to":"v0.5.2","loc":67,"days":17.37,"loc_per_day":3.9,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":22779.0,"index":0.022,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":1.0,"per_kloc:emoji_in_code":0.044,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":18.0,"findings_high":4.0,"findings_medium":11.0,"findings_low":3.0,"weighted_findings":7.1,"scanned_lines":22779.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/core/history_broker.py","line":141,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/core/history_broker.py:141"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":354,"fingerprint":"javascript.browser.security.insecure-document-method:src/ocr/paperless_local_ai_ui/assets/chat.js:354"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":354,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ocr/paperless_local_ai_ui/assets/chat.js:354"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/ocr/service.py","line":600,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/ocr/service.py:600"},{"rule_id":"opengrep/python.lang.security.deserialization.avoid-pickle","severity":"medium","message":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low]","path":"src/core/history_engine.py","line":169,"fingerprint":"python.lang.security.deserialization.avoid-pickle:src/core/history_engine.py:169"},{"rule_id":"opengrep/python.lang.security.deserialization.avoid-pickle","severity":"medium","message":"Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low]","path":"src/core/history_engine.py","line":192,"fingerprint":"python.lang.security.deserialization.avoid-pickle:src/core/history_engine.py:192"},{"rule_id":"opengrep/python.lang.security.dangerous-globals-use","severity":"medium","message":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low]","path":"src/core/rag_engine.py","line":1047,"fingerprint":"python.lang.security.dangerous-globals-use:src/core/rag_engine.py:1047"},{"rule_id":"opengrep/python.lang.security.dangerous-globals-use","severity":"medium","message":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low]","path":"src/core/rag_engine.py","line":1047,"fingerprint":"python.lang.security.dangerous-globals-use:src/core/rag_engine.py:1047"},{"rule_id":"opengrep/python.flask.security.audit.directly-returned-format-string","severity":"medium","message":"Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. [confidence medium]","path":"src/core/rag_engine.py","line":1311,"fingerprint":"python.flask.security.audit.directly-returned-format-string:src/core/rag_engine.py:1311"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"src/core/suggestion_bridge.py","line":240,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:src/core/suggestion_bridge.py:240"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"src/core/suggestion_bridge.py","line":274,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:src/core/suggestion_bridge.py:274"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":341,"fingerprint":"javascript.lang.security.html-in-template-string:src/ocr/paperless_local_ai_ui/assets/chat.js:341"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":348,"fingerprint":"javascript.lang.security.html-in-template-string:src/ocr/paperless_local_ai_ui/assets/chat.js:348"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":350,"fingerprint":"javascript.lang.security.html-in-template-string:src/ocr/paperless_local_ai_ui/assets/chat.js:350"},{"rule_id":"opengrep/python.django.security.injection.raw-html-format","severity":"medium","message":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is sa [confidence medium]","path":"src/ocr/paperless_local_ai_ui/injection.py","line":48,"fingerprint":"python.django.security.injection.raw-html-format:src/ocr/paperless_local_ai_ui/injection.py:48"},{"rule_id":"opengrep/rust.lang.security.args-os","severity":"low","message":"args_os should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"rust/core/src/bin/plai-healthcheck.rs","line":10,"fingerprint":"rust.lang.security.args-os:rust/core/src/bin/plai-healthcheck.rs:10"},{"rule_id":"opengrep/rust.lang.security.args-os","severity":"low","message":"args_os should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"rust/core/src/main.rs","line":34,"fingerprint":"rust.lang.security.args-os:rust/core/src/main.rs:34"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http","severity":"low","message":"Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium]","path":"src/core/prompt_ui.py","line":651,"fingerprint":"python.lang.security.audit.insecure-transport.requests.request-with-http:src/core/prompt_ui.py:651"}],"evidence":[],"data":{"rulesets":["python","rust","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":7.0,"vulnerabilities":14.0,"vulns_critical":0.0,"vulns_high":2.0,"vulns_medium":2.0,"vulns_low":2.0,"vulns_unknown":8.0,"penalty":26.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0340","severity":"high","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0340","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0340"},{"rule_id":"osv/RUSTSEC-2026-0343","severity":"high","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0343","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0343"},{"rule_id":"osv/RUSTSEC-2026-0338","severity":"medium","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0338","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0338"},{"rule_id":"osv/RUSTSEC-2026-0523","severity":"medium","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0523","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0523"},{"rule_id":"osv/RUSTSEC-2026-0524","severity":"medium","message":"quinn-proto@0.11.17 (crates.io) is affected by RUSTSEC-2026-0524","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.17 (crates.io):RUSTSEC-2026-0524"},{"rule_id":"osv/RUSTSEC-2026-0538","severity":"medium","message":"quinn-udp@0.5.15 (crates.io) is affected by RUSTSEC-2026-0538","path":"Cargo.lock","line":null,"fingerprint":"quinn-udp@0.5.15 (crates.io):RUSTSEC-2026-0538"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.43 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.43 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.43 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.43 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.15 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.15 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.53.1 (crates.io) is affected by RUSTSEC-2026-0386","path":"Cargo.lock","line":null,"fingerprint":"tokio@1.53.1 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0383","severity":"medium","message":"webpki-root-certs@1.0.9 (crates.io) is affected by RUSTSEC-2026-0383","path":"Cargo.lock","line":null,"fingerprint":"webpki-root-certs@1.0.9 (crates.io):RUSTSEC-2026-0383"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.43 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.43 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.43 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.43 (crates.io):GHSA-w44r-93j7-qv28"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":5.0,"findings":54.0,"findings_high":37.0,"findings_medium":4.0,"findings_low":13.0,"penalty":446.5},"findings":[{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/build-test-images.yml","line":16,"fingerprint":"excessive-permissions:.github/workflows/build-test-images.yml:16"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/build-test-images.yml","line":50,"fingerprint":"template-injection:.github/workflows/build-test-images.yml:50"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-test-images.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/build-test-images.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-test-images.yml","line":68,"fingerprint":"unpinned-uses:.github/workflows/build-test-images.yml:68"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-test-images.yml","line":73,"fingerprint":"unpinned-uses:.github/workflows/build-test-images.yml:73"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-test-images.yml","line":75,"fingerprint":"unpinned-uses:.github/workflows/build-test-images.yml:75"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-test-images.yml","line":82,"fingerprint":"unpinned-uses:.github/workflows/build-test-images.yml:82"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/pages-demo.yml","line":18,"fingerprint":"excessive-permissions:.github/workflows/pages-demo.yml:18"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/pages-demo.yml","line":19,"fingerprint":"excessive-permissions:.github/workflows/pages-demo.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages-demo.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/pages-demo.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages-demo.yml","line":53,"fingerprint":"unpinned-uses:.github/workflows/pages-demo.yml:53"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages-demo.yml","line":56,"fingerprint":"unpinned-uses:.github/workflows/pages-demo.yml:56"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages-demo.yml","line":69,"fingerprint":"unpinned-uses:.github/workflows/pages-demo.yml:69"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/publish.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/publish.yml:9"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/publish.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/publish.yml:10"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/publish.yml","line":11,"fingerprint":"excessive-permissions:.github/workflows/publish.yml:11"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":53,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:53"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":70,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:70"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":94,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:94"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":96,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:96"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":98,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:98"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":111,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:111"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":125,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:125"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":138,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:138"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish.yml","line":22,"fingerprint":"cache-poisoning:.github/workflows/publish.yml:22"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish.yml","line":53,"fingerprint":"cache-poisoning:.github/workflows/publish.yml:53"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/render-mermaid.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/render-mermaid.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/render-mermaid.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/render-mermaid.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/test.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/test.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/test.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":44,"fingerprint":"unpinned-uses:.github/workflows/test.yml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":61,"fingerprint":"unpinned-uses:.github/workflows/test.yml:61"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":80,"fingerprint":"unpinned-uses:.github/workflows/test.yml:80"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":4,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:4"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":9,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:9"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":23,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:23"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":41,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:41"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-test-images.yml","line":29,"fingerprint":"artipacked:.github/workflows/build-test-images.yml:29"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-test-images.yml","line":68,"fingerprint":"artipacked:.github/workflows/build-test-images.yml:68"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/pages-demo.yml","line":29,"fingerprint":"artipacked:.github/workflows/pages-demo.yml:29"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":21,"fingerprint":"artipacked:.github/workflows/publish.yml:21"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":52,"fingerprint":"artipacked:.github/workflows/publish.yml:52"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":70,"fingerprint":"artipacked:.github/workflows/publish.yml:70"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":94,"fingerprint":"artipacked:.github/workflows/publish.yml:94"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":23,"fingerprint":"artipacked:.github/workflows/test.yml:23"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":43,"fingerprint":"artipacked:.github/workflows/test.yml:43"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":61,"fingerprint":"artipacked:.github/workflows/test.yml:61"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":80,"fingerprint":"artipacked:.github/workflows/test.yml:80"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/build-test-images.yml","line":106,"fingerprint":"template-injection:.github/workflows/build-test-images.yml:106"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/build-test-images.yml","line":109,"fingerprint":"template-injection:.github/workflows/build-test-images.yml:109"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":1.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.5495,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0},{"kind":"posture","description":"rust/core/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"rust/core/Cargo.toml","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":972.0,"function_nloc":18069.0,"mean_ccn":4.5,"p90_ccn":10.0,"complex_functions":42.0,"long_functions":21.0,"many_param_functions":1.0,"risky_nloc_share":0.254},"findings":[],"evidence":[{"kind":"complex-function","description":"api in demo/mock-api.js: complexity 70, 124 lines","ref":"demo/mock-api.js","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/demo/mock-api.js#L732","weight":1.0},{"kind":"complex-function","description":"_dispatch in src/core/prompt_ui.py: complexity 66, 235 lines","ref":"src/core/prompt_ui.py","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/src/core/prompt_ui.py#L623","weight":1.0},{"kind":"complex-function","description":"merge_index_config in rust/core/src/rag.rs: complexity 46, 191 lines","ref":"rust/core/src/rag.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/rag.rs#L1031","weight":0.7666666666666667},{"kind":"complex-function","description":"merge_chat_defaults in rust/core/src/rag.rs: complexity 41, 150 lines","ref":"rust/core/src/rag.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/rag.rs#L876","weight":0.6833333333333333},{"kind":"complex-function","description":"validate_config in src/core/prompt_runtime.py: complexity 41, 85 lines","ref":"src/core/prompt_runtime.py","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/src/core/prompt_runtime.py#L265","weight":0.6833333333333333},{"kind":"complex-function","description":"validate in rust/core/src/app_config.rs: complexity 35, 121 lines","ref":"rust/core/src/app_config.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/app_config.rs#L237","weight":0.5833333333333334},{"kind":"complex-function","description":"renderMessages in src/ocr/paperless_local_ai_ui/assets/chat.js: complexity 35, 75 lines","ref":"src/ocr/paperless_local_ai_ui/assets/chat.js","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/src/ocr/paperless_local_ai_ui/assets/chat.js#L430","weight":0.5833333333333334},{"kind":"complex-function","description":"sync_index in src/core/rag_engine.py: complexity 31, 80 lines","ref":"src/core/rag_engine.py","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/src/core/rag_engine.py#L1078","weight":0.5166666666666667},{"kind":"complex-function","description":"run in rust/core/src/worker.rs: complexity 28, 146 lines","ref":"rust/core/src/worker.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/worker.rs#L435","weight":0.4666666666666667},{"kind":"complex-function","description":"validate_config in src/common/app_config.py: complexity 28, 121 lines","ref":"src/common/app_config.py","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/src/common/app_config.py#L163","weight":0.4666666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":17371.0,"duplicated_lines":952.0,"duplicated_share":0.0548,"files":57.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/app_config.rs:214 and src/common/app_config.py:173","ref":"rust/core/src/app_config.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/app_config.rs#L214","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/app_config.rs:429 and rust/core/src/prompt.rs:516","ref":"rust/core/src/app_config.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/app_config.rs#L429","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/app_config.rs:695 and rust/core/src/app_config.rs:704","ref":"rust/core/src/app_config.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/app_config.rs#L695","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/bridge.rs:260 and rust/core/src/bridge.rs:327","ref":"rust/core/src/bridge.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/bridge.rs#L260","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/control.rs:243 and rust/core/src/control.rs:261","ref":"rust/core/src/control.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/control.rs#L243","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/control.rs:871 and rust/core/src/worker.rs:594","ref":"rust/core/src/control.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/control.rs#L871","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/control.rs:885 and rust/core/src/prompt.rs:1194","ref":"rust/core/src/control.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/control.rs#L885","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/correspondent.rs:61 and src/core/correspondent_resolver.py:35","ref":"rust/core/src/correspondent.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/correspondent.rs#L61","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/history.rs:400 and rust/core/src/prompt.rs:663","ref":"rust/core/src/history.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/history.rs#L400","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust/core/src/history.rs:672 and src/core/history_common.py:65","ref":"rust/core/src/history.rs","url":"https://github.com/lucaperl/paperless-local-ai/blob/716044b35b7ed6208a1eaffcaf2dd78d15ef3744/rust/core/src/history.rs#L672","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"weighted_findings":19.75,"scanned_lines":22779.0,"category:best-practice":6.0,"category:correctness":4.0,"category:maintainability":2.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/core/prompt_runtime.py","line":473,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/core/prompt_runtime.py:473"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/core/rag_engine.py","line":451,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/core/rag_engine.py:451"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/core/rag_engine.py","line":781,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/core/rag_engine.py:781"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/core/worker.py","line":454,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/core/worker.py:454"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.","path":"src/ocr/service.py","line":986,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:src/ocr/service.py:986"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"src/core/prompt_ui.py","line":512,"fingerprint":"python.requests.best-practice.use-raise-for-status:src/core/prompt_ui.py:512"},{"rule_id":"opengrep/python.requests.best-practice.use-raise-for-status","severity":"medium","message":"There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a 500 error while you're only checking for a 401.","path":"src/core/rag_engine.py","line":2088,"fingerprint":"python.requests.best-practice.use-raise-for-status:src/core/rag_engine.py:2088"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_authenticated\" a function or an attribute? If it is a function, you may have meant user.is_authenticated() because user.is_authenticated is always true.","path":"src/ocr/paperless_local_ai_ui/relay.py","line":62,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/ocr/paperless_local_ai_ui/relay.py:62"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_superuser\" a function or an attribute? If it is a function, you may have meant user.is_superuser() because user.is_superuser is always true.","path":"src/ocr/paperless_local_ai_ui/relay.py","line":62,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/ocr/paperless_local_ai_ui/relay.py:62"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":89,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ocr/paperless_local_ai_ui/assets/chat.js:89"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":90,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ocr/paperless_local_ai_ui/assets/chat.js:90"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ocr/paperless_local_ai_ui/assets/chat.js","line":91,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ocr/paperless_local_ai_ui/assets/chat.js:91"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2813,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":3204.0,"source_lines":22779.0,"test_ratio":0.1407,"ci_files":5.0,"cochange_share":0.9487,"cochange_commits":39.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build-test-images.yml","ref":".github/workflows/build-test-images.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/pages-demo.yml","ref":".github/workflows/pages-demo.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/publish.yml","ref":".github/workflows/publish.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/render-mermaid.yml","ref":".github/workflows/render-mermaid.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest, go test, cargo test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (clippy, rustfmt, cargo fmt)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest","go test","cargo test"],"lint_commands":["clippy","rustfmt","cargo fmt"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":163.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":337.0,"escapes_per_kloc":31.227},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}