{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.218653Z","repo":{"ref":{"host":"github.com","owner":"mailgun","name":"godebug"},"default_branch":"master","clone_url":"https://github.com/mailgun/godebug.git","html_url":"https://github.com/mailgun/godebug","description":"DEPRECATED! https://github.com/derekparker/delve","stars":2476,"forks":102,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":906,"primary_language":"Go","license_spdx":"Apache-2.0","created_at":"2015-01-19T10:20:44Z","pushed_at":"2018-06-16T21:00:55Z","security_policy_url":null,"distribution":{"owner_created_at":"2010-10-21T01:02:03Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"bfb01ae9c26601793d8cf00f074489f7ad52288a","profile":{"lines_by_language":{"Go":160464},"files_by_category":{"source":224,"test":77,"other":43,"docs":30,"config":11},"source_lines":46628,"test_lines":113836},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.086},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":68.7,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":32.0,"duplication":60.0,"lint":99.2,"testing":86.5,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 2.44, CI runs tests; 38% of function code in complex or long functions; 9% duplicated lines. Weakest area: complexity."},"security":{"score":78.3,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":90.4,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 6 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":208.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":164296.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2015-01":{"loc":23542,"attributed_loc":0},"2015-02":{"loc":2676,"attributed_loc":0},"2015-03":{"loc":1393,"attributed_loc":0},"2015-04":{"loc":2902,"attributed_loc":0},"2015-05":{"loc":14936,"attributed_loc":0},"2015-06":{"loc":193,"attributed_loc":0},"2015-07":{"loc":116001,"attributed_loc":0},"2015-08":{"loc":53,"attributed_loc":0},"2015-09":{"loc":2600,"attributed_loc":0},"2017-06":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":91.0,"flagged_units":0.0,"pre_ai_era_bursts":1.0,"pre_ai_era_measured_loc":12720.0,"pre_ai_era_burst_loc":2600.0,"measured_loc":12720.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":621.47267777704,"median_loc_per_hour":55.25,"pr_timed_units":0.0,"excluded_import_loc":151576.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["0fba1a9ee93a07068c46b9ef01cb35de06fc8d9f","db1b76e960c66fd0ff5e0734f25cfc66ae603381","e9908505e46fb7769b419c6bb5e0b61ad1ded3c8"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":46628.0,"index":0.086,"count:narrated_steps":4.0,"per_kloc:narrated_steps":0.086,"files:narrated_steps":3.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Finally, check for illegal use of the ellipsis","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkcallexpr.go:235","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkcallexpr.go#L235","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, all the (unaugmented) non-test packages and their","ref":"Godeps/_workspace/src/golang.org/x/tools/go/loader/loader.go:92","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/golang.org/x/tools/go/loader/loader.go#L92","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Then, each package P for which testing is desired is augmented by","ref":"Godeps/_workspace/src/golang.org/x/tools/go/loader/loader.go:96","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/golang.org/x/tools/go/loader/loader.go#L96","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, try to scan a handle.","ref":"Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go:1862","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go#L1862","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":42.0,"findings_high":6.0,"findings_medium":36.0,"findings_low":0.0,"weighted_findings":13.5,"scanned_lines":46628.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.reflect-makefunc","severity":"high","message":"'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability. [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/evalfunclit.go","line":10,"fingerprint":"go.lang.security.audit.reflect-makefunc:Godeps/_workspace/src/github.com/0xfaded/eval/evalfunclit.go:10"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/common.go","line":73,"fingerprint":"go.lang.security.audit.dangerous-exec-command:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/common.go:73"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go","line":31,"fingerprint":"go.lang.security.audit.dangerous-exec-command:Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go:31"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go","line":59,"fingerprint":"go.lang.security.audit.dangerous-exec-command:Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go:59"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"Godeps/_workspace/src/golang.org/x/tools/go/loader/cgo.go","line":147,"fingerprint":"go.lang.security.audit.dangerous-exec-command:Godeps/_workspace/src/golang.org/x/tools/go/loader/cgo.go:147"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd.go","line":478,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd.go:478"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go","line":229,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go:229"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go","line":51,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:51"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go","line":63,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:63"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go","line":74,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:74"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go","line":81,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:81"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go","line":83,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:83"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/errors.go","line":1061,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/errors.go:1061"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/panics.go","line":58,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:Godeps/_workspace/src/github.com/0xfaded/eval/panics.go:58"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkassignstmt_gen.go","line":5,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkassignstmt_gen.go:5"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_nonconst_gen.go","line":7,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_nonconst_gen.go:7"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_typed_gen.go","line":7,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_typed_gen.go:7"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbuiltin_gen.go","line":5,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbuiltin_gen.go:5"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_const_conv_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_const_conv_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_func_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_func_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkstarexpr_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkstarexpr_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_addr_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_addr_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_typed_gen.go","line":6,"fingerprint":"go.lang.security.audit.xss.import-text-template:Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_typed_gen.go:6"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/input_windows.go","line":155,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:155"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/input_windows.go","line":157,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:157"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/input_windows.go","line":167,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:167"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/input_windows.go","line":174,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:174"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/input_windows.go","line":308,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:308"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/output.go","line":42,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/output.go:42"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/output_windows.go","line":24,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:24"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/output_windows.go","line":31,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:31"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/output_windows.go","line":36,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:36"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/output_windows.go","line":41,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:41"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/output_windows.go","line":46,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:46"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/output_windows.go","line":52,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:52"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/unixmode.go","line":11,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/unixmode.go:11"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"Godeps/_workspace/src/github.com/peterh/liner/unixmode.go","line":34,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:Godeps/_workspace/src/github.com/peterh/liner/unixmode.go:34"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"gen/gen.go","line":17,"fingerprint":"go.lang.security.audit.xss.import-text-template:gen/gen.go:17"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"lib/debug.go","line":342,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:lib/debug.go:342"}],"evidence":[],"data":{"rulesets":["go"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2003.0,"function_nloc":30367.0,"mean_ccn":4.65,"p90_ccn":10.0,"complex_functions":121.0,"long_functions":32.0,"many_param_functions":0.0,"risky_nloc_share":0.3799},"findings":[],"evidence":[{"kind":"complex-function","description":"builtin in Godeps/_workspace/src/golang.org/x/tools/go/types/builtins.go: complexity 123, 419 lines","ref":"Godeps/_workspace/src/golang.org/x/tools/go/types/builtins.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/golang.org/x/tools/go/types/builtins.go#L22","weight":1.0},{"kind":"complex-function","description":"stmt in Godeps/_workspace/src/golang.org/x/tools/go/types/stmt.go: complexity 119, 408 lines","ref":"Godeps/_workspace/src/golang.org/x/tools/go/types/stmt.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/golang.org/x/tools/go/types/stmt.go#L203","weight":1.0},{"kind":"complex-function","description":"exprInternal in Godeps/_workspace/src/golang.org/x/tools/go/types/expr.go: complexity 111, 381 lines","ref":"Godeps/_workspace/src/golang.org/x/tools/go/types/expr.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/golang.org/x/tools/go/types/expr.go#L941","weight":1.0},{"kind":"complex-function","description":"checkStmt in Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go: complexity 106, 374 lines","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go#L39","weight":1.0},{"kind":"complex-function","description":"Prompt in Godeps/_workspace/src/github.com/peterh/liner/line.go: complexity 83, 298 lines","ref":"Godeps/_workspace/src/github.com/peterh/liner/line.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/peterh/liner/line.go#L466","weight":1.0},{"kind":"complex-function","description":"yaml_parser_scan_flow_scalar in Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go: complexity 81, 210 lines","ref":"Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go#L2304","weight":1.0},{"kind":"complex-function","description":"main in testdata/single-file-tests/select-out.go: complexity 72, 263 lines","ref":"testdata/single-file-tests/select-out.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/testdata/single-file-tests/select-out.go#L36","weight":1.0},{"kind":"complex-function","description":"checkBinaryExpr in Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go: complexity 71, 190 lines","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go#L16","weight":1.0},{"kind":"complex-function","description":"yaml_parser_fetch_next_token in Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go: complexity 70, 100 lines","ref":"Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go#L665","weight":1.0},{"kind":"complex-function","description":"Body in Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go: complexity 65, 85 lines","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go#L116","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":33155.0,"duplicated_lines":2825.0,"duplicated_share":0.0852,"files":224.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/ast.go:665 and Godeps/_workspace/src/github.com/0xfaded/eval/ast.go:675","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/ast.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/ast.go#L665","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go:422 and Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go:449","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go#L422","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkbuiltin.go:48 and Godeps/_workspace/src/github.com/0xfaded/eval/checkbuiltin.go:510","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkbuiltin.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkbuiltin.go#L48","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go:272 and Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go:298","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go#L272","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkindexexpr.go:11 and Godeps/_workspace/src/github.com/0xfaded/eval/checksliceexpr.go:12","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkindexexpr.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkindexexpr.go#L11","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go:358 and Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go:434","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go#L358","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/consttype.go:117 and Godeps/_workspace/src/github.com/0xfaded/eval/consttype.go:129","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/consttype.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/consttype.go#L117","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/evalbinaryexpr.go:127 and Godeps/_workspace/src/github.com/0xfaded/eval/evalbinaryexpr.go:170","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/evalbinaryexpr.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/evalbinaryexpr.go#L127","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/evalbuiltin.go:54 and Godeps/_workspace/src/github.com/0xfaded/eval/evalbuiltin.go:68","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/evalbuiltin.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/evalbuiltin.go#L54","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/evalunaryexpr.go:56 and Godeps/_workspace/src/github.com/0xfaded/eval/evalunaryexpr.go:71","ref":"Godeps/_workspace/src/github.com/0xfaded/eval/evalunaryexpr.go","url":"https://github.com/mailgun/godebug/blob/bfb01ae9c26601793d8cf00f074489f7ad52288a/Godeps/_workspace/src/github.com/0xfaded/eval/evalunaryexpr.go#L56","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":3.0,"weighted_findings":1.5,"scanned_lines":46628.0,"category:correctness":3.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd.go","line":400,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd.go:400"},{"rule_id":"opengrep/go.lang.correctness.hardcoded-eq-true-or-false","severity":"low","message":"Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on which expression is in the code.","path":"Godeps/_workspace/src/golang.org/x/tools/go/gcimporter/exportdata.go","line":26,"fingerprint":"go.lang.correctness.hardcoded-eq-true-or-false:Godeps/_workspace/src/golang.org/x/tools/go/gcimporter/exportdata.go:26"},{"rule_id":"opengrep/go.lang.correctness.hardcoded-eq-true-or-false","severity":"low","message":"Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on which expression is in the code.","path":"Godeps/_workspace/src/golang.org/x/tools/go/loader/cgo.go","line":144,"fingerprint":"go.lang.correctness.hardcoded-eq-true-or-false:Godeps/_workspace/src/golang.org/x/tools/go/loader/cgo.go:144"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.6545,"test_lines":113836.0,"source_lines":46628.0,"test_ratio":2.4414,"ci_files":1.0,"cochange_share":0.1636,"cochange_commits":165.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":71.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}