{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.244729Z","repo":{"ref":{"host":"github.com","owner":"maragudk","name":"hallucinationsearch"},"default_branch":"main","clone_url":"https://github.com/maragudk/hallucinationsearch.git","html_url":"https://github.com/maragudk/hallucinationsearch","description":"Hallucinated search results and websites.","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1947,"primary_language":"Go","license_spdx":"MIT","created_at":"2026-04-23T07:17:07Z","pushed_at":"2026-09-17T22:05:17Z","security_policy_url":"https://github.com/maragudk/hallucinationsearch/security/policy","distribution":{"owner_created_at":"2020-08-03T07:51:26Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"11be94fa1682f40fde0159949edecf4283b2d58d","profile":{"lines_by_language":{"Go":3932,"SQL":100,"JavaScript":9},"files_by_category":{"source":35,"docs":28,"config":14,"test":7,"binary":6,"other":4,"generated":1},"source_lines":3195,"test_lines":846},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.51,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":2.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.156},"summary":"Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase."},"quality":{"score":83.0,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":95.8,"duplication":79.9,"lint":72.4,"testing":88.2,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.26, CI runs tests; 1% of function code in complex or long functions; 4% duplicated lines. Weakest area: docs."},"security":{"score":58.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":51.3,"dependencies":37.4,"ci_actions":0.9,"posture":100.0,"scorecard":null},"summary":"Security posture is weak: 53 known vulnerabilities in 13 dependencies; 1 high-severity SAST findings; 22 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":44.0,"attributed_commits":1.0,"attributed_commit_share":0.022727272727272728,"effective_loc":4712.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"e100148c8b9213ef71f3e5cea7d1dc0346cbd8b1","url":"https://github.com/maragudk/hallucinationsearch/commit/e100148c8b9213ef71f3e5cea7d1dc0346cbd8b1","weight":0.9}],"data":{"attributed_loc_by_commit":{"e100148c8b9213ef71f3e5cea7d1dc0346cbd8b1":0},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":1,"loc":0,"first_seen":1758188931,"last_seen":1758188931},"claude-code":{"name":"Claude Code","commits":1,"loc":0,"first_seen":1758188931,"last_seen":1758188931}},"monthly":{"2025-09":{"loc":771,"attributed_loc":0},"2025-10":{"loc":4,"attributed_loc":0},"2025-11":{"loc":79,"attributed_loc":0},"2026-02":{"loc":14,"attributed_loc":0},"2026-03":{"loc":97,"attributed_loc":0},"2026-04":{"loc":3747,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1758188211.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1758188211},{"tool":"generic-agent","path":"AGENTS.md","added_at":1758188211}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":18.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":4712.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":715.1207115628971,"median_loc_per_hour":472.6588161124549,"pr_timed_units":8.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":3195.0,"index":0.156,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":1.0,"per_kloc:emoji_in_code":0.313,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":16.0,"findings_high":1.0,"findings_medium":15.0,"findings_low":0.0,"weighted_findings":5.9,"scanned_lines":3095.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":48,"fingerprint":"dockerfile.security.missing-user:Dockerfile:48"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"http/image.go","line":113,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:http/image.go:113"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-fprintf-to-responsewriter","severity":"medium","message":"Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low]","path":"http/search.go","line":348,"fingerprint":"go.lang.security.audit.xss.no-fprintf-to-responsewriter:http/search.go:348"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"http/search.go","line":535,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:http/search.go:535"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"llm/constraints.go","line":5,"fingerprint":"go.lang.security.audit.crypto.math-random-used:llm/constraints.go:5"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"public/scripts/datastar.js","line":2,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:public/scripts/datastar.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"public/scripts/datastar.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:public/scripts/datastar.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"public/scripts/datastar.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:public/scripts/datastar.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"public/scripts/datastar.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:public/scripts/datastar.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"public/scripts/datastar.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:public/scripts/datastar.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"public/scripts/datastar.js","line":2,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:public/scripts/datastar.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"public/scripts/datastar.js","line":2,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:public/scripts/datastar.js:2"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"public/scripts/datastar.js","line":5,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:public/scripts/datastar.js:5"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/scripts/datastar.js","line":5,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:public/scripts/datastar.js:5"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/scripts/datastar.js","line":5,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:public/scripts/datastar.js:5"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/scripts/datastar.js","line":8,"fingerprint":"javascript.lang.security.html-in-template-string:public/scripts/datastar.js:8"}],"evidence":[],"data":{"rulesets":["go","javascript","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":13.0,"vulnerabilities":53.0,"vulns_critical":8.0,"vulns_high":5.0,"vulns_medium":12.0,"vulns_low":4.0,"vulns_unknown":24.0,"penalty":59.0},"findings":[{"rule_id":"osv/GHSA-jppx-rxg9-jmrx","severity":"critical","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-jppx-rxg9-jmrx"},{"rule_id":"osv/GHSA-f5wc-c3c7-36mc","severity":"critical","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-f5wc-c3c7-36mc"},{"rule_id":"osv/GHSA-vgwf-h737-ff37","severity":"critical","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-vgwf-h737-ff37"},{"rule_id":"osv/GHSA-89gr-r52h-f8rx","severity":"critical","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-89gr-r52h-f8rx"},{"rule_id":"osv/GHSA-rm3j-f69w-wqmq","severity":"critical","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-rm3j-f69w-wqmq"},{"rule_id":"osv/GHSA-5cgq-3rg8-m6cv","severity":"critical","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-5cgq-3rg8-m6cv"},{"rule_id":"osv/GHSA-x527-x647-q7gg","severity":"critical","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-x527-x647-q7gg"},{"rule_id":"osv/GHSA-p77j-4mvh-x3m3","severity":"critical","message":"google.golang.org/grpc@1.72.1 (Go) is affected by GO-2026-4762, GHSA-p77j-4mvh-x3m3","path":"go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.72.1 (Go):GHSA-p77j-4mvh-x3m3"},{"rule_id":"osv/GHSA-q4h4-gmj2-qvw2","severity":"high","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-q4h4-gmj2-qvw2"},{"rule_id":"osv/GHSA-w879-237q-wc7r","severity":"high","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-w879-237q-wc7r"},{"rule_id":"osv/GHSA-hrxh-6v49-42gf","severity":"high","message":"google.golang.org/grpc@1.72.1 (Go) is affected by GO-2026-6061, GHSA-hrxh-6v49-42gf","path":"go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.72.1 (Go):GHSA-hrxh-6v49-42gf"},{"rule_id":"osv/GHSA-vp52-pcj8-j9qc","severity":"high","message":"google.golang.org/grpc@1.72.1 (Go) is affected by GO-2026-6348, GHSA-vp52-pcj8-j9qc","path":"go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.72.1 (Go):GHSA-vp52-pcj8-j9qc"},{"rule_id":"osv/GHSA-2v4p-qf9q-27wj","severity":"high","message":"google.golang.org/grpc@1.72.1 (Go) is affected by GO-2026-6443, GHSA-2v4p-qf9q-27wj","path":"go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.72.1 (Go):GHSA-2v4p-qf9q-27wj"},{"rule_id":"osv/GHSA-3fxj-6jh8-hvhx","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.5 (Go) is affected by GO-2026-5774, GHSA-3fxj-6jh8-hvhx","path":"go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.5 (Go):GHSA-3fxj-6jh8-hvhx"},{"rule_id":"osv/GO-2026-5775","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.5 (Go) is affected by GO-2026-5775","path":"go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.5 (Go):GO-2026-5775"},{"rule_id":"osv/GO-2026-5777","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.5 (Go) is affected by GO-2026-5777","path":"go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.5 (Go):GO-2026-5777"},{"rule_id":"osv/GHSA-j6qf-3m9c-vwj3","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.5 (Go) is affected by GHSA-j6qf-3m9c-vwj3","path":"go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.5 (Go):GHSA-j6qf-3m9c-vwj3"},{"rule_id":"osv/GO-2026-5158","severity":"medium","message":"go.opentelemetry.io/otel@1.43.0 (Go) is affected by GO-2026-5158","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel@1.43.0 (Go):GO-2026-5158"},{"rule_id":"osv/GHSA-w8rr-5gcm-pp58","severity":"medium","message":"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@1.28.0 (Go) is affected by GO-2026-4985, GHSA-w8rr-5gcm-pp58","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@1.28.0 (Go):GHSA-w8rr-5gcm-pp58"},{"rule_id":"osv/GHSA-w8rr-5gcm-pp58","severity":"medium","message":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.28.0 (Go) is affected by GO-2026-4985, GHSA-w8rr-5gcm-pp58","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.28.0 (Go):GHSA-w8rr-5gcm-pp58"},{"rule_id":"osv/GHSA-q7gw-24fr-5p69","severity":"medium","message":"go.opentelemetry.io/otel/sdk@1.43.0 (Go) is affected by GHSA-q7gw-24fr-5p69","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/sdk@1.43.0 (Go):GHSA-q7gw-24fr-5p69"},{"rule_id":"osv/GHSA-q7gw-24fr-5p69","severity":"medium","message":"go.opentelemetry.io/otel/trace@1.43.0 (Go) is affected by GHSA-q7gw-24fr-5p69","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/trace@1.43.0 (Go):GHSA-q7gw-24fr-5p69"},{"rule_id":"osv/GHSA-45gg-vh54-h5m9","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-45gg-vh54-h5m9"},{"rule_id":"osv/GHSA-78mq-xcr3-xm33","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-78mq-xcr3-xm33"},{"rule_id":"osv/GHSA-qpw4-5x99-6vjp","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-qpw4-5x99-6vjp"},{"rule_id":"osv/GHSA-9m57-25v3-79x9","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GHSA-9m57-25v3-79x9"},{"rule_id":"osv/GO-2026-5932","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-5932","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GO-2026-5932"},{"rule_id":"osv/GO-2026-6303","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-6303","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GO-2026-6303"},{"rule_id":"osv/GO-2026-6354","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-6354","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GO-2026-6354"},{"rule_id":"osv/GO-2026-6355","severity":"medium","message":"golang.org/x/crypto@0.45.0 (Go) is affected by GO-2026-6355","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.45.0 (Go):GO-2026-6355"},{"rule_id":"osv/GO-2026-4918","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-4918","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-4918"},{"rule_id":"osv/GO-2026-5025","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-5025","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-5025"},{"rule_id":"osv/GO-2026-5026","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-5026","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-5026"},{"rule_id":"osv/GO-2026-5027","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-5027","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-5027"},{"rule_id":"osv/GHSA-5cv4-jp36-h3mw","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-5028, GHSA-5cv4-jp36-h3mw","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GHSA-5cv4-jp36-h3mw"},{"rule_id":"osv/GO-2026-5029","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-5029","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-5029"},{"rule_id":"osv/GO-2026-5030","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-5030","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-5030"},{"rule_id":"osv/GO-2026-5942","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-5942","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-5942"},{"rule_id":"osv/GO-2026-6603","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-6603","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-6603"},{"rule_id":"osv/GO-2026-6610","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-6610","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-6610"},{"rule_id":"osv/GO-2026-6611","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-6611","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-6611"},{"rule_id":"osv/GO-2026-6612","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-6612","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-6612"},{"rule_id":"osv/GO-2026-6617","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-6617","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-6617"},{"rule_id":"osv/GO-2026-6860","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-6860","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-6860"},{"rule_id":"osv/GO-2026-6866","severity":"medium","message":"golang.org/x/net@0.47.0 (Go) is affected by GO-2026-6866","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.47.0 (Go):GO-2026-6866"},{"rule_id":"osv/GO-2026-5024","severity":"medium","message":"golang.org/x/sys@0.42.0 (Go) is affected by GO-2026-5024","path":"go.mod","line":null,"fingerprint":"golang.org/x/sys@0.42.0 (Go):GO-2026-5024"},{"rule_id":"osv/GO-2026-5970","severity":"medium","message":"golang.org/x/text@0.31.0 (Go) is affected by GO-2026-5970","path":"go.mod","line":null,"fingerprint":"golang.org/x/text@0.31.0 (Go):GO-2026-5970"},{"rule_id":"osv/GO-2026-6629","severity":"medium","message":"golang.org/x/text@0.31.0 (Go) is affected by GO-2026-6629","path":"go.mod","line":null,"fingerprint":"golang.org/x/text@0.31.0 (Go):GO-2026-6629"},{"rule_id":"osv/GHSA-qc2q-p7wx-3px3","severity":"medium","message":"google.golang.org/grpc@1.72.1 (Go) is affected by GO-2026-6441, GHSA-qc2q-p7wx-3px3","path":"go.mod","line":null,"fingerprint":"google.golang.org/grpc@1.72.1 (Go):GHSA-qc2q-p7wx-3px3"},{"rule_id":"osv/GHSA-8wmf-6v46-5gfg","severity":"low","message":"go.opentelemetry.io/otel/exporters/otlp/otlptrace@1.28.0 (Go) is affected by GO-2026-6505, GHSA-8wmf-6v46-5gfg","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/exporters/otlp/otlptrace@1.28.0 (Go):GHSA-8wmf-6v46-5gfg"},{"rule_id":"osv/GHSA-8wmf-6v46-5gfg","severity":"low","message":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.28.0 (Go) is affected by GO-2026-6505, GHSA-8wmf-6v46-5gfg","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.28.0 (Go):GHSA-8wmf-6v46-5gfg"},{"rule_id":"osv/GHSA-8wmf-6v46-5gfg","severity":"low","message":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.28.0 (Go) is affected by GO-2026-6505, GHSA-8wmf-6v46-5gfg","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.28.0 (Go):GHSA-8wmf-6v46-5gfg"},{"rule_id":"osv/GHSA-8wmf-6v46-5gfg","severity":"low","message":"go.opentelemetry.io/otel/sdk@1.43.0 (Go) is affected by GO-2026-6505, GHSA-8wmf-6v46-5gfg","path":"go.mod","line":null,"fingerprint":"go.opentelemetry.io/otel/sdk@1.43.0 (Go):GHSA-8wmf-6v46-5gfg"}],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":4.0,"findings":29.0,"findings_high":22.0,"findings_medium":6.0,"findings_low":1.0,"penalty":280.3},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/cd.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/cd.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/cd.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/cd.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/cd.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/cd.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/cd.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/cd.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/cd.yml","line":34,"fingerprint":"unpinned-uses:.github/workflows/cd.yml:34"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:40"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":48,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:48"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":71,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:71"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":76,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:76"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":94,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:94"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":99,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:99"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":105,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:105"},{"rule_id":"zizmor/unpinned-images","severity":"high","message":"unpinned image references [confidence high]","path":".github/workflows/ci.yml","line":60,"fingerprint":"unpinned-images:.github/workflows/ci.yml:60"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compatibility.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/compatibility.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compatibility.yml","line":41,"fingerprint":"unpinned-uses:.github/workflows/compatibility.yml:41"},{"rule_id":"zizmor/unpinned-images","severity":"high","message":"unpinned image references [confidence high]","path":".github/workflows/compatibility.yml","line":27,"fingerprint":"unpinned-images:.github/workflows/compatibility.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/security.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/security.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/security.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/security.yml:26"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":3,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:3"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":16,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:16"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":35,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:35"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":54,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:54"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":87,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:87"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/cd.yml","line":18,"fingerprint":"artipacked:.github/workflows/cd.yml:18"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":1.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.9091,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: https://github.com/maragudk/hallucinationsearch/security/policy","ref":"https://github.com/maragudk/hallucinationsearch/security/policy","url":null,"weight":0.0},{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":315.0,"function_nloc":1886.0,"mean_ccn":3.8,"p90_ccn":9.0,"complex_functions":14.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0143},"findings":[],"evidence":[{"kind":"complex-function","description":"it in public/scripts/datastar.js: complexity 30, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L8","weight":0.5},{"kind":"complex-function","description":"Xe in public/scripts/datastar.js: complexity 30, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L4","weight":0.5},{"kind":"complex-function","description":"qt in public/scripts/datastar.js: complexity 29, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L8","weight":0.48333333333333334},{"kind":"complex-function","description":"sniffImageMime in http/image.go: complexity 23, 14 lines","ref":"http/image.go","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/http/image.go#L121","weight":0.38333333333333336},{"kind":"complex-function","description":"Jt in public/scripts/datastar.js: complexity 23, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L8","weight":0.38333333333333336},{"kind":"complex-function","description":"D in public/scripts/datastar.js: complexity 22, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L8","weight":0.36666666666666664},{"kind":"complex-function","description":"apply in public/scripts/datastar.js: complexity 21, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L5","weight":0.35},{"kind":"complex-function","description":"wn in public/scripts/datastar.js: complexity 20, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L8","weight":0.3333333333333333},{"kind":"complex-function","description":"An in public/scripts/datastar.js: complexity 18, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L8","weight":0.3},{"kind":"complex-function","description":"apply in public/scripts/datastar.js: complexity 18, 1 lines","ref":"public/scripts/datastar.js","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/public/scripts/datastar.js#L8","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2248.0,"duplicated_lines":84.0,"duplicated_share":0.0374,"files":35.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: html/results.go:161 and html/results.go:186","ref":"html/results.go","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/html/results.go#L161","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: http/search.go:399 and http/search.go:489","ref":"http/search.go","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/http/search.go#L399","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: jobs/ads.go:4 and jobs/search.go:4","ref":"jobs/ads.go","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/jobs/ads.go#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: llm/llm.go:171 and llm/llm.go:290","ref":"llm/llm.go","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/llm/llm.go#L171","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: model/search.go:29 and model/search.go:52","ref":"model/search.go","url":"https://github.com/maragudk/hallucinationsearch/blob/11be94fa1682f40fde0159949edecf4283b2d58d/model/search.go#L29","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":7.0,"weighted_findings":4.0,"scanned_lines":3095.0,"category:correctness":7.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/app/main.go","line":60,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/app/main.go:60"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"llm/image_store.go","line":79,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:llm/image_store.go:79"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"public/scripts/datastar.js","line":8,"fingerprint":"javascript.lang.correctness.no-stringify-keys:public/scripts/datastar.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`s` is assigned twice; the first assignment is useless","path":"public/scripts/datastar.js","line":8,"fingerprint":"javascript.lang.correctness.useless-assignment:public/scripts/datastar.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`s` is assigned twice; the first assignment is useless","path":"public/scripts/datastar.js","line":8,"fingerprint":"javascript.lang.correctness.useless-assignment:public/scripts/datastar.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"public/scripts/datastar.js","line":8,"fingerprint":"javascript.lang.correctness.useless-assignment:public/scripts/datastar.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`s` is assigned twice; the first assignment is useless","path":"public/scripts/datastar.js","line":8,"fingerprint":"javascript.lang.correctness.useless-assignment:public/scripts/datastar.js:8"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.5296,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":846.0,"source_lines":3195.0,"test_ratio":0.2648,"ci_files":4.0,"cochange_share":0.3333,"cochange_commits":21.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/cd.yml","ref":".github/workflows/cd.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/compatibility.yml","ref":".github/workflows/compatibility.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/security.yml","ref":".github/workflows/security.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (golangci-lint)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":["golangci-lint"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":20.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":0.0,"other_lines":3195.0,"files_blamed":35.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:other_findings":7.0,"quality:other_per_kloc":2.191,"security:ai_findings":0.0,"security:other_findings":15.0,"security:other_per_kloc":4.695},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}