{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.426765Z","repo":{"ref":{"host":"github.com","owner":"mrothroc","name":"biosurface"},"default_branch":"main","clone_url":"https://github.com/mrothroc/biosurface.git","html_url":"https://github.com/mrothroc/biosurface","description":"Deterministically audits the claims in AI-assisted single-cell & Perturb-seq analyses — a claim is trusted only where independent verification surfaces converge, not on one engine's verdict. An application of https://michael.roth.rocks/research/trust-topology/","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":8474,"primary_language":"Go","license_spdx":"NOASSERTION","created_at":"2026-07-08T00:12:08Z","pushed_at":"2026-07-14T13:50:21Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-11-01T01:37:25Z","owner_type":"User","release_assets":[]}},"commit_sha":"817f80e386fb14f81b5744e840a6ca464e50de38","profile":{"lines_by_language":{"Go":50662,"Python":635,"JavaScript":290,"Shell":200,"Ruby":18},"files_by_category":{"test":149,"source":147,"other":105,"config":63,"docs":36,"vendored":13,"oversized":4,"generated":1},"source_lines":20606,"test_lines":31199},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.8716,"estimated_share":0.0,"ai_artifacts":7.0,"flagged_work_units":11.0,"flagged_releases":null,"style_index":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":76.7,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":65.4,"duplication":62.9,"lint":86.5,"testing":100.0,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.51, CI runs tests; 14% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety."},"security":{"score":81.0,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":92.2,"dependencies":100.0,"ci_actions":63.1,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 1 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":264.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":55660.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-07":{"loc":55660,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":7.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1783950920.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"cmd/biosurface/CLAUDE.md (claude-code configuration)","ref":"cmd/biosurface/CLAUDE.md","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"internal/CLAUDE.md (claude-code configuration)","ref":"internal/CLAUDE.md","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"internal/extract/CLAUDE.md (claude-code configuration)","ref":"internal/extract/CLAUDE.md","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/extract/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"internal/ingest/CLAUDE.md (claude-code configuration)","ref":"internal/ingest/CLAUDE.md","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/ingest/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"internal/llm/CLAUDE.md (claude-code configuration)","ref":"internal/llm/CLAUDE.md","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/llm/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"internal/rules/CLAUDE.md (claude-code configuration)","ref":"internal/rules/CLAUDE.md","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/rules/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1783950920},{"tool":"claude-code","path":"cmd/biosurface/CLAUDE.md","added_at":1783950920},{"tool":"claude-code","path":"internal/CLAUDE.md","added_at":1783950920},{"tool":"claude-code","path":"internal/extract/CLAUDE.md","added_at":1783950920},{"tool":"claude-code","path":"internal/ingest/CLAUDE.md","added_at":1783950920},{"tool":"claude-code","path":"internal/llm/CLAUDE.md","added_at":1783950920},{"tool":"claude-code","path":"internal/rules/CLAUDE.md","added_at":1783950920}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":29.0,"flagged_units":11.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":55660.0,"flagged_loc":48512.0,"flagged_loc_share":0.8715774344232843,"max_loc_per_hour":1605.1232479458677,"median_loc_per_hour":568.2895802012258,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"5,535 lines of first-party code in ~3.4h (1,605 lines/hour, 14 commit session)","ref":"c87682240b0628004a545a403e3711ff422cc5cf","url":"https://github.com/mrothroc/biosurface/commit/c87682240b0628004a545a403e3711ff422cc5cf","weight":0.4815369743837603},{"kind":"velocity-burst","description":"5,825 lines of first-party code in ~4.2h (1,401 lines/hour, 11 commit session)","ref":"c5c753f2c1320260663431e47921052b288d00ef","url":"https://github.com/mrothroc/biosurface/commit/c5c753f2c1320260663431e47921052b288d00ef","weight":0.420352799679273},{"kind":"velocity-burst","description":"8,443 lines of first-party code in ~6.5h (1,309 lines/hour, 28 commit session)","ref":"757b13eb217e7e6dcae61f274127640fc802a6a7","url":"https://github.com/mrothroc/biosurface/commit/757b13eb217e7e6dcae61f274127640fc802a6a7","weight":0.39259622836476366},{"kind":"velocity-burst","description":"4,544 lines of first-party code in ~4.5h (1,008 lines/hour, 19 commit session)","ref":"d2b2af3c7bf715e1a10ad90ce0d3bb9d90387d12","url":"https://github.com/mrothroc/biosurface/commit/d2b2af3c7bf715e1a10ad90ce0d3bb9d90387d12","weight":0.30233612617052735},{"kind":"velocity-burst","description":"2,626 lines of first-party code in ~2.7h (967 lines/hour, 7 commit session)","ref":"484cd7efc1267cf0b86c5bf1c2cd02775d048e9f","url":"https://github.com/mrothroc/biosurface/commit/484cd7efc1267cf0b86c5bf1c2cd02775d048e9f","weight":0.29019543640642587},{"kind":"velocity-burst","description":"3,230 lines of first-party code in ~3.6h (901 lines/hour, 17 commit session)","ref":"45911d483f39cf58bde3738bce121028e38e6be9","url":"https://github.com/mrothroc/biosurface/commit/45911d483f39cf58bde3738bce121028e38e6be9","weight":0.27039764359351987},{"kind":"velocity-burst","description":"4,910 lines of first-party code in ~5.8h (847 lines/hour, 12 commit session)","ref":"d47ce4e4cee906b42b7c2f9f6a3647fc8b238c31","url":"https://github.com/mrothroc/biosurface/commit/d47ce4e4cee906b42b7c2f9f6a3647fc8b238c31","weight":0.25422119948223787},{"kind":"velocity-burst","description":"2,330 lines of first-party code in ~3.0h (773 lines/hour, 8 commit session)","ref":"400f47a8675620c1eaddea96becc570cee74faec","url":"https://github.com/mrothroc/biosurface/commit/400f47a8675620c1eaddea96becc570cee74faec","weight":0.23190489355819738},{"kind":"velocity-burst","description":"5,951 lines of first-party code in ~9.3h (639 lines/hour, 26 commit session)","ref":"5ff0dd0c575cd2ef0a15b5127bcc11d7a61bca1a","url":"https://github.com/mrothroc/biosurface/commit/5ff0dd0c575cd2ef0a15b5127bcc11d7a61bca1a","weight":0.19169291338582675},{"kind":"velocity-burst","description":"3,753 lines of first-party code in ~6.0h (622 lines/hour, 8 commit session)","ref":"59bed50d267846bb0acc61e78415f2659015a6a8","url":"https://github.com/mrothroc/biosurface/commit/59bed50d267846bb0acc61e78415f2659015a6a8","weight":0.18655313665025083},{"kind":"velocity-burst","description":"1,365 lines of first-party code in ~2.4h (568 lines/hour, 9 commit session)","ref":"de54d682ebbcb03f4fdd1361405af9e02fa9405a","url":"https://github.com/mrothroc/biosurface/commit/de54d682ebbcb03f4fdd1361405af9e02fa9405a","weight":0.17048687406036772}],"data":{"flagged_loc_by_commit":{"d7db7071f230106e1ad89f30f0310c61b9bbb399":944,"0a9bb446cced5adb483a2f063d1b51fa7fcc581e":329,"a2f996ca793de0ad88c501a80a0248a57bbba6f3":826,"0c9bfc69b077d2b9f6f014f08832db83d88f3e9f":360,"a5d8dba9699278b02720e74c7760cd365dc8adba":175,"b01ed4495743cc946d9db54e07ea11c06e37e062":811,"59bed50d267846bb0acc61e78415f2659015a6a8":9,"bfac7d343ceec8370277e43b16591166c3544175":299,"f19d58f7d488a2bdaeaa4db1100abf66b0d1725d":268,"7a18955617934ce984ff7b4b24070f97d3c79efb":11,"c38adc4874d7b3a8e1472efbef394a1142783c72":210,"c48b8cc256ef44f0ad05aeb28235d340ee709cde":178,"e678d8d2c613435c3234e8e6b9b3ee1f05fe261b":552,"39ac809e3e95500483f8d4a95da9bd135600bbff":1095,"b570f06f6a5aa3295ddae29198368f74e1594f82":597,"925a0022084987c50697dd74ad5d979c9c9ef808":106,"6f9b3cfa918a2517b58576ce0aa32f79c09335a1":558,"c7e0846f7ece0047631f61ee72d672fc6b45c35b":164,"3cf5d0061f7e1d38bf030d55f5ed341f386f2a88":279,"d598afa4e9fad9a392eaac92a4809630d6b061a8":38,"25a0298f24280253e72d3706fb5cccc5a7ddeaba":409,"a635d6b436b4559b05bb677ce19836173570ab73":207,"3b4f9f33bb20bfa06104062c559f14713ede3447":410,"cc1ad8b9b2be901cec9a6f7f202ff59139d029bb":27,"1df1073ea70ae3fa172e00160bcbde14d4a4d409":56,"3644c61a1719d5f8a94eccdc07b690077b0bc19c":15,"1fe34ded1cd82ab100e06e1f13d9db3c68440302":316,"285afc31cc17a362eb17dbd34e962c3ca0fcb2fe":671,"956baa113ad972dbb8d717e76cf412d1cf994772":386,"3cedf2893b2fccb976bbd6c901dea9be7d7b412f":297,"01457fef45d8939e756d17fafdf80a6cd7763d41":337,"7879a461a73baca954790c3789887ec6ffe6d41a":493,"13361a18c084eff141de38d0e03cb9ceacb3774c":321,"4722fdbadbe99846e1444d129be991fb3f8837e0":224,"fe0e4f4772e0a6efb0bb43cb5d25adabeb6d02ef":125,"757b13eb217e7e6dcae61f274127640fc802a6a7":93,"c84c894fc9768277ffbbff136f9470346e2e9acd":411,"31226cfe4a8020200bc7f27d4655a300022daed8":415,"54c7067786382d1e193ffdacf629d998416f7fa9":336,"35fbcb10ee2dbaf30ac6207ee56a084acd491059":221,"6c82b76a3b44540bd5b133d00560ae7cd922f383":181,"511bdf8ead555d81e62b26b1d5360d15d8ead915":223,"ae24ae046f6bef17de6af36feb886947804c8a19":446,"2609daf9065bfb9ec159a05af3b9ec353cf803f9":543,"25d3e1063fb7a511a15981161bbadc94817beecc":255,"d4366428d425289f07306d2a9ba7c83d31a64a87":128,"ef9971116b146f775fb91bf36232102ee7964000":310,"2464975f41041ca41bcb9b9e61a8bd203b145828":272,"3969bb35c7fa25980c1fb12b855155ca67e8d843":205,"6dbe1d5a6e4d06f11037085e4d01ba4299070493":29,"085888c86caaac91869753bb5b2a0146e285ee19":584,"99cef6d76779c098d16993a9a1773284d8011257":224,"da0d5e30715f30d74a62e775a1717d8923dee3d8":347,"e60783b812c77795d8672de5cae61a0a97de9f23":151,"4f68f79b67defc73057f149fe679f15869fd0c68":276,"467a16ccd71afc28038a95fc712c17cec93b56f2":40,"736adbb77c2f74a50bf31d840bf16e8715b6e11a":56,"e24b189996e4b0bb1f15af00ae81d354bc13e5ac":77,"4e3cb020946672645e5d49519ac0a507076af39f":16,"53a33d18dd5db6215a3dbfceae35c71a610a413d":20,"2c6e752cd6fe31d4ef38071f4dd44955b91b2a6c":102,"5ff0dd0c575cd2ef0a15b5127bcc11d7a61bca1a":83,"c97fb9b9c7325d228896c0fe16878a3ae1ceb271":293,"ee4a0fe401f8181bccc02c80cf4405169148b2c4":241,"834b41bcd114e7fb13b3b5ddee4754a40260f48d":659,"02d15ff01fcb7fdf09eaf3e9bf4617e62d09acfd":309,"17127e96ee7ae319ade422a13847ab670f4b09eb":800,"638f326500c8a5e4291c985aa41ade78963c8db4":763,"84532087874606364f03ceecf7c6c9fed2a3643f":29,"d0cb731f917d088600de4f98d9909629da65b2bf":1415,"2cfe7c1fcac0fd831006d2bf2586c84ebd5f0db7":142,"9c2d1578588bab40ef6bfe9811cd0e5ead70125d":769,"c5c753f2c1320260663431e47921052b288d00ef":405,"322b36fa22f6742627116688ca031e5f3ea0860c":54,"7b587e5b32533aace672e70f18de512f74ff139c":37,"eb207afaa898c568976d9a8c242d13cbe29a5bab":394,"ca731ea20bb34567d6cf4145fc8de048367973c8":173,"83aa693b37552bd89d8ef6d6a48076c8264f7425":91,"e90e23adc75220b2fd91f4d21713a59747ca4b43":161,"03241d34b9fb7e01c7b8fb1bfddb6df3942fcf81":123,"fa6fb37f71c4eceaba9e1df3c653fffdd59a08cd":2,"811f227fd6305cdb68e46bdc913f94dea1eeb697":5,"5317b08ecb0822a0b7842e63e821340478cd771c":666,"c42fcdbe57642d841bc8c5b7ffd7672028e6442f":332,"474c06ce5d961ae24f80b94ed1fb665729887edf":261,"f6a0fefe44ef194e3ccadf9677a04279930a3a10":283,"f4da8c71606f6817ab76ae4bedf0876eb1883b7e":5,"3d63c9ce1f836be6d9e8f7fd0ebb2d8ea4fa39e8":256,"de3282c02fa534646e08240cdc6f6bc331e661fc":3,"45911d483f39cf58bde3738bce121028e38e6be9":384,"d53594e3634c450c323d5b85aad9d054b4ef7f83":82,"0bee85834b30a12344e168da8c7861093c90b813":550,"de26c4891c724d4afcfd8572be34f87648168204":263,"1936eeba3ef1f3281db8e1bc1c745f21540183b0":91,"5ef8e5060af7529c0e1a984933831d39a56f6b0c":477,"8b6eb6bcc755b7f4278ba2991410010ec204628e":486,"663ad1337929d8880d37539826f457fb560cd778":222,"400f47a8675620c1eaddea96becc570cee74faec":159,"51644e78ec6f033ca2ddca85b630544af37b5dbd":132,"6101e5d062f96a1b223ed2e424566c268f9defb5":465,"d3bc4b599ad4b201742c6f85de1ed582faee9208":141,"db4e4c9a104e6164088898d4db0b0ab76f543956":270,"ab7c55fb8cafd903e3688ea459d64c2291e9ac58":62,"d56967b79f96c741f8829793296add70a7e4d827":116,"0852575009e3fa8eb904a930fba54cbc589a1145":70,"84462d603bc9e5509afa249c216ca60ee65891a8":90,"de54d682ebbcb03f4fdd1361405af9e02fa9405a":19,"3cfca9449a1d7d1f45a7de65c1e192c9182c999b":197,"9c56cc627c435ef3aacb56928f4bd0be6566faa8":695,"8a02e7f983ce93b3b0f7b8385d3da273f35ec1fb":218,"ca1e12d6ca5da3293f014df9ebc7e039fc4e56fc":357,"42a89279fb869aa5a23d8da0bf4bd3eaee4dbfbb":371,"c87a3aeac18b3fd4d3a0531d37442b137f945a9a":103,"6341a7dad70f2bd2cd2b0ca08c48bffc41cd189e":92,"5a45f668a066394b47387c15023765490a1d3cf2":740,"2192ceb2edb0cf3d85885cc3fbb0e080ce6967d1":408,"4fac980278b2bd0b51885c6b1460168d5779b6cc":644,"85a11e0e89012de2a2a19197242e8600e7873e6e":377,"e47b479c7df27f2c5663756088015777c34df5e6":232,"55b55bd349255eab422dadf9ed820d0ed6ba9984":748,"c87682240b0628004a545a403e3711ff422cc5cf":353,"22aa2700f1461c12876b5a7f03f08737a8522b90":89,"6b0edd0178e62617aaa4714fb690173579c6f5ac":373,"c16a0442280b5707e30ce6248ba28eafbea4ef00":779,"6d35b41464e347a93f92b834e128775fc783129f":186,"65157bf0673e887bc319962dbbc0bad6dbec777f":369,"7d6459706dac80b9e03687aba940191f3e09dfe4":190,"4afd45402635fa5cb437e8527f8f452006064fc8":1171,"15d01e334a3e4e263166a3c5244116d7c954a82a":362,"7c91a1a57ecf3b74f36e624fc6bf72bdaa0e2c7a":338,"8ffe521fc574c2b61637d92c085b9022f415ceb4":314,"c27d470cf5a443de9346427d4c47a01c94c68c9b":404,"d47ce4e4cee906b42b7c2f9f6a3647fc8b238c31":335,"5e71e9c03285cc05ce5edc75082b2f847a1d442a":257,"40d30e553e91c379e059d5a0b8eb8ab711523e0d":533,"f9c4566c2e8485b88a4dbe61ef73673de2dc6b87":289,"6eda0c67474b7d7e74c771834377d9aade49eb73":411,"e427cc7af9fd771c5fa0d53262df9f0fcb9a2ad9":507,"4c035ad7f25c7aea24e1bb7d413901353c1938cb":216,"484cd7efc1267cf0b86c5bf1c2cd02775d048e9f":413,"81b7b44e118c7c075507b03a5419514e7d6e1269":77,"3bbc0dea43876937b09e44e2fc6f7e78634da9b0":122,"cf9f5206c667f5b4046600e177a2a98dcc9dd350":302,"f4462da3c93854b0618f5ff70c10ffd89be8e154":207,"bfae7cc492b1fba87dbf7ef3aa2ce478b11f96fa":140,"f85ac7b0fe1b0745cdcdbc05e3568c2a6d129ed7":201,"b5ccfb190bc1fa0b56a7432da17565dd7071016e":384,"3fb6254b90f49e01ed4966994269bf270da5e3c1":227,"e4351c07a63e09c7f399005e26170471fc578c6c":45,"2234bbad588ee22cfccdfe619eecb8c8a3173e4a":316,"62ffb302714e4270aca1a781d2175054d13a3229":403,"87f14f7e76da97aab7844dcecbef285da4722f32":471,"9f6d33228f5a0052b67621de6a06a44871500cb0":330,"6eb656854caf58318e7dfd5d4b68cd1041120f59":7,"9138b26d86dc4a09532c0f4bc3ba54761afba075":387,"3ea3d3d7835934b391def0b32e4a67830fbf86ed":108,"b955376a3304b254e70b3563dad6b128ef2f09a3":584,"82ddd919ba34bc6e51091d364f483140dc38e288":182,"d2b2af3c7bf715e1a10ad90ce0d3bb9d90387d12":51},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":20606.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":20.0,"findings_high":1.0,"findings_medium":15.0,"findings_low":4.0,"weighted_findings":4.75,"scanned_lines":20606.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/llm/codex/codex.go","line":205,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/llm/codex/codex.go:205"},{"rule_id":"opengrep/go.lang.security.audit.xss.unsafe-template-type","severity":"medium","message":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use  [confidence low]","path":"internal/adapters/serve/assets.go","line":55,"fingerprint":"go.lang.security.audit.xss.unsafe-template-type:internal/adapters/serve/assets.go:55"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter","severity":"medium","message":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low]","path":"internal/adapters/serve/assets.go","line":153,"fingerprint":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter:internal/adapters/serve/assets.go:153"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter","severity":"medium","message":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low]","path":"internal/adapters/serve/assets.go","line":210,"fingerprint":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter:internal/adapters/serve/assets.go:210"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"internal/adapters/serve/claims.go","line":48,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:internal/adapters/serve/claims.go:48"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"internal/adapters/serve/claims.go","line":95,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:internal/adapters/serve/claims.go:95"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"internal/adapters/serve/claims.go","line":155,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:internal/adapters/serve/claims.go:155"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"internal/adapters/serve/claims.go","line":212,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:internal/adapters/serve/claims.go:212"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"internal/adapters/serve/manifest_write.go","line":62,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:internal/adapters/serve/manifest_write.go:62"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"internal/adapters/serve/serve.go","line":268,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:internal/adapters/serve/serve.go:268"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"internal/report/markdown/report.go","line":9,"fingerprint":"go.lang.security.audit.xss.import-text-template:internal/report/markdown/report.go:9"},{"rule_id":"opengrep/go.lang.security.audit.xss.unsafe-template-type","severity":"medium","message":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use  [confidence low]","path":"internal/report/viewer/viewer.go","line":230,"fingerprint":"go.lang.security.audit.xss.unsafe-template-type:internal/report/viewer/viewer.go:230"},{"rule_id":"opengrep/go.lang.security.audit.xss.unsafe-template-type","severity":"medium","message":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use  [confidence low]","path":"internal/report/viewer/viewer.go","line":291,"fingerprint":"go.lang.security.audit.xss.unsafe-template-type:internal/report/viewer/viewer.go:291"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/dataprep/extract_de_replogle.py","line":92,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/dataprep/extract_de_replogle.py:92"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/dataprep/extract_de_replogle.py","line":127,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/dataprep/extract_de_replogle.py:127"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/dataprep/extract_de_replogle.py","line":167,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/dataprep/extract_de_replogle.py:167"},{"rule_id":"opengrep/python.lang.security.use-defusedcsv","severity":"low","message":"Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the  [confidence low]","path":"scripts/dataprep/compute_enrichment_replogle.py","line":161,"fingerprint":"python.lang.security.use-defusedcsv:scripts/dataprep/compute_enrichment_replogle.py:161"},{"rule_id":"opengrep/python.lang.security.use-defusedcsv","severity":"low","message":"Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the  [confidence low]","path":"scripts/dataprep/extract_concordance.py","line":40,"fingerprint":"python.lang.security.use-defusedcsv:scripts/dataprep/extract_concordance.py:40"},{"rule_id":"opengrep/python.lang.security.use-defusedcsv","severity":"low","message":"Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the  [confidence low]","path":"scripts/dataprep/extract_de_replogle.py","line":117,"fingerprint":"python.lang.security.use-defusedcsv:scripts/dataprep/extract_de_replogle.py:117"},{"rule_id":"opengrep/python.lang.security.use-defusedcsv","severity":"low","message":"Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the  [confidence low]","path":"scripts/dataprep/extract_de_replogle.py","line":189,"fingerprint":"python.lang.security.use-defusedcsv:scripts/dataprep/extract_de_replogle.py:189"}],"evidence":[],"data":{"rulesets":["go","python","javascript","bash","ruby"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":4.0,"findings_high":2.0,"findings_medium":2.0,"findings_low":0.0,"penalty":27.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":15,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:18"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":14,"fingerprint":"artipacked:.github/workflows/ci.yml:14"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:10"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":807.0,"function_nloc":11916.0,"mean_ccn":3.75,"p90_ccn":9.0,"complex_functions":17.0,"long_functions":5.0,"many_param_functions":2.0,"risky_nloc_share":0.1413},"findings":[],"evidence":[{"kind":"complex-function","description":"ValidateSourceGroundedClaim in internal/domain/claimlint/source_grounding.go: complexity 37, 82 lines","ref":"internal/domain/claimlint/source_grounding.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/domain/claimlint/source_grounding.go#L34","weight":0.6166666666666667},{"kind":"complex-function","description":"EnforceClaimAuthorPolicy in internal/config/policyguard/policyguard.go: complexity 36, 100 lines","ref":"internal/config/policyguard/policyguard.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/config/policyguard/policyguard.go#L26","weight":0.6},{"kind":"complex-function","description":"runClaimExtract in cmd/biosurface/claim_extract.go: complexity 29, 187 lines","ref":"cmd/biosurface/claim_extract.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/claim_extract.go#L76","weight":0.48333333333333334},{"kind":"complex-function","description":"Run in internal/rules/robustness/gate.go: complexity 27, 62 lines","ref":"internal/rules/robustness/gate.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/rules/robustness/gate.go#L94","weight":0.45},{"kind":"complex-function","description":"main in scripts/dataprep/extract_de_replogle.py: complexity 27, 84 lines","ref":"scripts/dataprep/extract_de_replogle.py","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/scripts/dataprep/extract_de_replogle.py#L125","weight":0.45},{"kind":"complex-function","description":"Run in internal/app/audit/service.go: complexity 26, 112 lines","ref":"internal/app/audit/service.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/app/audit/service.go#L78","weight":0.43333333333333335},{"kind":"complex-function","description":"Validate in internal/config/policy.go: complexity 24, 40 lines","ref":"internal/config/policy.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/config/policy.go#L156","weight":0.4},{"kind":"complex-function","description":"LoadArtifacts in internal/ingest/bundle/bundle.go: complexity 24, 81 lines","ref":"internal/ingest/bundle/bundle.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/ingest/bundle/bundle.go#L76","weight":0.4},{"kind":"complex-function","description":"claimAdd in internal/adapters/mcp/handler.go: complexity 23, 84 lines","ref":"internal/adapters/mcp/handler.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/adapters/mcp/handler.go#L225","weight":0.38333333333333336},{"kind":"complex-function","description":"manifestWrite in internal/adapters/mcp/manifest_write.go: complexity 23, 68 lines","ref":"internal/adapters/mcp/manifest_write.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/adapters/mcp/manifest_write.go#L39","weight":0.38333333333333336}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":14990.0,"duplicated_lines":1158.0,"duplicated_share":0.0773,"files":147.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/biosurface/claim.go:4 and cmd/biosurface/claim_extract.go:5","ref":"cmd/biosurface/claim.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/claim.go#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/biosurface/claim.go:41 and internal/adapters/mcp/handler.go:444","ref":"cmd/biosurface/claim.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/claim.go#L41","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/biosurface/claim.go:211 and cmd/biosurface/claim.go:343","ref":"cmd/biosurface/claim.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/claim.go#L211","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/biosurface/claim.go:419 and cmd/biosurface/main.go:116","ref":"cmd/biosurface/claim.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/claim.go#L419","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/biosurface/claim.go:426 and cmd/biosurface/serve.go:56","ref":"cmd/biosurface/claim.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/claim.go#L426","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/biosurface/claim_recommend.go:4 and cmd/biosurface/serve.go:4","ref":"cmd/biosurface/claim_recommend.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/claim_recommend.go#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/biosurface/reaudit.go:35 and cmd/biosurface/reaudit.go:79","ref":"cmd/biosurface/reaudit.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/cmd/biosurface/reaudit.go#L35","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: demo/live_loop.sh:154 and demo/live_loop.sh:181","ref":"demo/live_loop.sh","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/demo/live_loop.sh#L154","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/adapters/claimstore/local/convert.go:4 and internal/adapters/claimstore/remote/convert.go:4","ref":"internal/adapters/claimstore/local/convert.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/adapters/claimstore/local/convert.go#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/adapters/claimstore/local/local.go:90 and internal/adapters/claimstore/remote/remote.go:112","ref":"internal/adapters/claimstore/local/local.go","url":"https://github.com/mrothroc/biosurface/blob/817f80e386fb14f81b5744e840a6ca464e50de38/internal/adapters/claimstore/local/local.go#L90","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":6.0,"weighted_findings":12.0,"scanned_lines":20606.0,"category:best-practice":3.0,"category:correctness":3.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"scripts/dataprep/compute_enrichment_replogle.py","line":48,"fingerprint":"python.lang.best-practice.open-never-closed:scripts/dataprep/compute_enrichment_replogle.py:48"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"scripts/dataprep/compute_enrichment_replogle.py","line":75,"fingerprint":"python.lang.best-practice.open-never-closed:scripts/dataprep/compute_enrichment_replogle.py:75"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"scripts/dataprep/compute_enrichment_replogle.py","line":157,"fingerprint":"python.lang.best-practice.open-never-closed:scripts/dataprep/compute_enrichment_replogle.py:157"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/biosurface/main.go","line":278,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/biosurface/main.go:278"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/testutil/bundle.go","line":21,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/testutil/bundle.go:21"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/testutil/bundle.go","line":42,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/testutil/bundle.go:42"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":31199.0,"source_lines":20606.0,"test_ratio":1.5141,"ci_files":1.0,"cochange_share":0.901,"cochange_commits":192.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (golangci-lint, go vet)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":["golangci-lint","go vet"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":269.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}