{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.491740Z","repo":{"ref":{"host":"github.com","owner":"nateware","name":"claude-todo"},"default_branch":"main","clone_url":"https://github.com/nateware/claude-todo.git","html_url":"https://github.com/nateware/claude-todo","description":"Claude code todo app test","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":262,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-02-05T23:56:07Z","pushed_at":"2026-10-01T09:15:19Z","security_policy_url":null,"distribution":{"owner_created_at":"2008-04-14T22:46:42Z","owner_type":"User","release_assets":[]}},"commit_sha":"75394bfc6836139bc6ddfb45e8d748d5fa4c8828","profile":{"lines_by_language":{"TypeScript":2470,"JavaScript":1551,"Shell":155,"SQL":32},"files_by_category":{"source":32,"test":19,"config":9,"docs":8,"other":4,"generated":3,"binary":1},"source_lines":1661,"test_lines":2547},"pillars":{"ai_provenance":{"score":5.6,"confidence":0.78,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.056,"suspected_share":0.5636,"estimated_share":0.056,"ai_artifacts":1.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":1.806},"summary":"Explicit AI attribution on 6% of first-party code added; an estimated 6% including velocity signals."},"quality":{"score":75.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":100.0,"duplication":82.0,"lint":73.6,"testing":51.0,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.53, no CI test run detected; 0% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing."},"security":{"score":58.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":57.8,"dependencies":35.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 29 known vulnerabilities in 11 dependencies; 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":33.0,"checked":33.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":32.0,"attributed_commits":14.0,"attributed_commit_share":0.4375,"effective_loc":4356.0,"attributed_loc":244.0,"attributed_loc_share":0.05601469237832874,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 14 attributed commits, 244 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"75394bfc6836139bc6ddfb45e8d748d5fa4c8828","url":"https://github.com/nateware/claude-todo/commit/75394bfc6836139bc6ddfb45e8d748d5fa4c8828","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"29897bb9937a06e94e79ed6ed6d72706045bb363","url":"https://github.com/nateware/claude-todo/commit/29897bb9937a06e94e79ed6ed6d72706045bb363","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5dbbedc20404593c548d8fa56aa21c451c3bcfb6","url":"https://github.com/nateware/claude-todo/commit/5dbbedc20404593c548d8fa56aa21c451c3bcfb6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3258a0d340b48975e1fef1184a0d1ff331b69eaa","url":"https://github.com/nateware/claude-todo/commit/3258a0d340b48975e1fef1184a0d1ff331b69eaa","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"abac64d80c05d281b841b1dfd88a3c689f214bdf","url":"https://github.com/nateware/claude-todo/commit/abac64d80c05d281b841b1dfd88a3c689f214bdf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"88a85cbf0888569cedd4c521f6262d4423d5c38e","url":"https://github.com/nateware/claude-todo/commit/88a85cbf0888569cedd4c521f6262d4423d5c38e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"62a4e2fabbafe379df3c840bd031a523325c6121","url":"https://github.com/nateware/claude-todo/commit/62a4e2fabbafe379df3c840bd031a523325c6121","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"dea5e29a1b43498b20eeb824df8f47af171af2b3","url":"https://github.com/nateware/claude-todo/commit/dea5e29a1b43498b20eeb824df8f47af171af2b3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6fe96f5e4d0ad17b21241f7872d4b0022be74905","url":"https://github.com/nateware/claude-todo/commit/6fe96f5e4d0ad17b21241f7872d4b0022be74905","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"42e97d448c90bc99f8c5701172a4e076c2134e97","url":"https://github.com/nateware/claude-todo/commit/42e97d448c90bc99f8c5701172a4e076c2134e97","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9208a8d1c5107b525ec7f38383535859b0e3033b","url":"https://github.com/nateware/claude-todo/commit/9208a8d1c5107b525ec7f38383535859b0e3033b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2a7b5d948953810af974a8cb1b14e3c2c8fc5ab7","url":"https://github.com/nateware/claude-todo/commit/2a7b5d948953810af974a8cb1b14e3c2c8fc5ab7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a995cf285b27ab52e29e22f04128617eeaa62cee","url":"https://github.com/nateware/claude-todo/commit/a995cf285b27ab52e29e22f04128617eeaa62cee","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"cd199bdc4b806a7fb1ea88a7927ccec9a7c20929","url":"https://github.com/nateware/claude-todo/commit/cd199bdc4b806a7fb1ea88a7927ccec9a7c20929","weight":0.9}],"data":{"attributed_loc_by_commit":{"cd199bdc4b806a7fb1ea88a7927ccec9a7c20929":27,"a995cf285b27ab52e29e22f04128617eeaa62cee":15,"2a7b5d948953810af974a8cb1b14e3c2c8fc5ab7":52,"9208a8d1c5107b525ec7f38383535859b0e3033b":2,"42e97d448c90bc99f8c5701172a4e076c2134e97":0,"6fe96f5e4d0ad17b21241f7872d4b0022be74905":72,"dea5e29a1b43498b20eeb824df8f47af171af2b3":38,"62a4e2fabbafe379df3c840bd031a523325c6121":1,"88a85cbf0888569cedd4c521f6262d4423d5c38e":0,"abac64d80c05d281b841b1dfd88a3c689f214bdf":0,"3258a0d340b48975e1fef1184a0d1ff331b69eaa":8,"5dbbedc20404593c548d8fa56aa21c451c3bcfb6":1,"29897bb9937a06e94e79ed6ed6d72706045bb363":2,"75394bfc6836139bc6ddfb45e8d748d5fa4c8828":26},"tools":{"claude-code":{"name":"Claude Code","commits":14,"loc":244,"first_seen":1790772187,"last_seen":1790846078}},"monthly":{"2026-02":{"loc":4109,"attributed_loc":0},"2026-09":{"loc":210,"attributed_loc":207},"2026-10":{"loc":37,"attributed_loc":37}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1770413767.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/settings.local.json (claude-code configuration)","ref":".claude/settings.local.json","url":"https://github.com/nateware/claude-todo/blob/75394bfc6836139bc6ddfb45e8d748d5fa4c8828/.claude/settings.local.json","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/settings.local.json","added_at":1770413767}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":7.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":4356.0,"flagged_loc":2455.0,"flagged_loc_share":0.5635904499540864,"max_loc_per_hour":558.7305601213807,"median_loc_per_hour":96.5,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,455 lines of first-party code in ~4.4h (559 lines/hour, 2 commit session)","ref":"4fa3c8ddba21580fe41692223e2705539ee13809","url":"https://github.com/nateware/claude-todo/commit/4fa3c8ddba21580fe41692223e2705539ee13809","weight":0.1676191680364142}],"data":{"flagged_loc_by_commit":{"38433fd90614ea8f7a2584df8ff7bc45c5176d7e":1452,"4fa3c8ddba21580fe41692223e2705539ee13809":1003},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1661.0,"index":1.806,"count:narrated_steps":3.0,"per_kloc:narrated_steps":1.806,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Remove from old list (shift items below up)","ref":"backend/routes/api/todos/index.js:96","url":"https://github.com/nateware/claude-todo/blob/75394bfc6836139bc6ddfb45e8d748d5fa4c8828/backend/routes/api/todos/index.js#L96","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Make room in new list (shift all down)","ref":"backend/routes/api/todos/index.js:101","url":"https://github.com/nateware/claude-todo/blob/75394bfc6836139bc6ddfb45e8d748d5fa4c8828/backend/routes/api/todos/index.js#L101","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Toggle completion and place at top (sort_order = 0)","ref":"backend/routes/api/todos/index.js:106","url":"https://github.com/nateware/claude-todo/blob/75394bfc6836139bc6ddfb45e8d748d5fa4c8828/backend/routes/api/todos/index.js#L106","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"findings_high":1.0,"findings_medium":3.0,"findings_low":0.0,"weighted_findings":2.55,"scanned_lines":1629.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"frontend/Dockerfile","line":22,"fingerprint":"dockerfile.security.missing-user:frontend/Dockerfile:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dbPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"backend/db/database.js","line":14,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:backend/db/database.js:14"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dbPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"backend/db/database.js","line":15,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:backend/db/database.js:15"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `migrationPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"backend/db/migrations.js","line":40,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:backend/db/migrations.js:40"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":11.0,"vulnerabilities":29.0,"vulns_critical":1.0,"vulns_high":7.0,"vulns_medium":15.0,"vulns_low":6.0,"vulns_unknown":0.0,"penalty":63.0},"findings":[{"rule_id":"osv/GHSA-pqg4-j6r4-53mv","severity":"critical","message":"shell-quote@1.9.0 (npm) is affected by GHSA-pqg4-j6r4-53mv","path":"package-lock.json","line":null,"fingerprint":"shell-quote@1.9.0 (npm):GHSA-pqg4-j6r4-53mv"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.3.0 (npm) is affected by GHSA-27r3-jxmh-p828","path":"frontend/package-lock.json","line":null,"fingerprint":"body-parser@2.3.0 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"frontend/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-xjj6-f33q-929c","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.3.1 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.3.1 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-jggr-w7fw-pc2j","severity":"medium","message":"fast-copy@4.0.2 (npm) is affected by GHSA-jggr-w7fw-pc2j","path":"backend/package-lock.json","line":null,"fingerprint":"fast-copy@4.0.2 (npm):GHSA-jggr-w7fw-pc2j"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-wjr9-j795-jxcr","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@4.2.1 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@4.2.1 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@4.2.1 (npm) is affected by GHSA-wjr9-j795-jxcr","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@4.2.1 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-p458-7748-mcp3","severity":"medium","message":"@vitest/ui@5.0.3 (npm) is affected by GHSA-p458-7748-mcp3","path":"frontend/package-lock.json","line":null,"fingerprint":"@vitest/ui@5.0.3 (npm):GHSA-p458-7748-mcp3"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.16.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"frontend/package-lock.json","line":null,"fingerprint":"qs@6.16.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-f72v-6w45-q472","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.3.1 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.3.1 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.3.1 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.3.1 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.3.1 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.3.1 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-vfpm-58rq-9qcg","severity":"medium","message":"vite@8.3.1 (npm) is affected by GHSA-vfpm-58rq-9qcg","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.3.1 (npm):GHSA-vfpm-58rq-9qcg"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-333x-w4r6-6crp","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@4.2.1 (npm) is affected by GHSA-333x-w4r6-6crp","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@4.2.1 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@4.2.1 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"backend/package-lock.json","line":null,"fingerprint":"fast-uri@4.2.1 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-389g-gv7q-r4x8","severity":"low","message":"fastify@5.12.5 (npm) is affected by GHSA-389g-gv7q-r4x8","path":"backend/package-lock.json","line":null,"fingerprint":"fastify@5.12.5 (npm):GHSA-389g-gv7q-r4x8"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.3.1 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.3.1 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":91.0,"function_nloc":866.0,"mean_ccn":1.91,"p90_ccn":3.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1150.0,"duplicated_lines":38.0,"duplicated_share":0.033,"files":32.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/app/components/todos/ConfirmDialog.tsx:16 and frontend/app/components/todos/ErrorDialog.tsx:16","ref":"frontend/app/components/todos/ConfirmDialog.tsx","url":"https://github.com/nateware/claude-todo/blob/75394bfc6836139bc6ddfb45e8d748d5fa4c8828/frontend/app/components/todos/ConfirmDialog.tsx#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/app/components/todos/TodoItem.tsx:39 and frontend/app/components/todos/TodoItem.tsx:83","ref":"frontend/app/components/todos/TodoItem.tsx","url":"https://github.com/nateware/claude-todo/blob/75394bfc6836139bc6ddfb45e8d748d5fa4c8828/frontend/app/components/todos/TodoItem.tsx#L39","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":2.0,"scanned_lines":1629.0,"category:best-practice":2.0},"findings":[{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/app/components/todos/TodoItem.tsx","line":34,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/app/components/todos/TodoItem.tsx:34"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/app/components/todos/TodoItem.tsx","line":35,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/app/components/todos/TodoItem.tsx:35"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.6,"test_lines":2547.0,"source_lines":1661.0,"test_ratio":1.5334,"ci_files":0.0,"cochange_share":0.15,"cochange_commits":20.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":193.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: frontend/tsconfig.json","ref":"frontend/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":191.0,"other_lines":1470.0,"files_blamed":32.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":2.0,"quality:other_per_kloc":1.361,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":3.0,"security:other_per_kloc":2.041},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}