{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.546972Z","repo":{"ref":{"host":"github.com","owner":"neplexlabs","name":"commandkit"},"default_branch":"main","clone_url":"https://github.com/neplexlabs/commandkit.git","html_url":"https://github.com/neplexlabs/commandkit","description":"The discord.js meta-framework with features such as AI-powered command handler, analytics, feature flags, and more","stars":164,"forks":23,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":9861,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2023-07-01T19:36:12Z","pushed_at":"2026-10-26T03:39:03Z","security_policy_url":"https://github.com/neplexlabs/commandkit/security/policy","distribution":{"owner_created_at":"2023-06-16T04:09:02Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"e65f24305f2e05780dda4c5b86de2df2752fc09a","profile":{"lines_by_language":{"TypeScript":40890,"JavaScript":733,"SQL":36},"files_by_category":{"other":745,"source":424,"docs":138,"config":106,"test":19,"binary":13,"oversized":1,"generated":1},"source_lines":37938,"test_lines":3721},"pillars":{"ai_provenance":{"score":0.2,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0019,"suspected_share":0.1059,"estimated_share":0.0019,"ai_artifacts":1.0,"flagged_work_units":4.0,"flagged_releases":0.0,"style_index":0.619},"summary":"Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals."},"quality":{"score":71.6,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":72.0,"duplication":58.0,"lint":80.7,"testing":72.8,"docs":80.0,"type_safety":60.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.10, CI runs tests; 11% of function code in complex or long functions; 9% duplicated lines. Weakest area: duplication."},"security":{"score":55.9,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":80.5,"dependencies":6.4,"ci_actions":5.2,"posture":80.0,"scorecard":null},"summary":"Security posture is weak: 62 known vulnerabilities in 26 dependencies; 15 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":69.0,"checked":69.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1305.0,"attributed_commits":11.0,"attributed_commit_share":0.00842911877394636,"effective_loc":85795.0,"attributed_loc":163.0,"attributed_loc_share":0.0018998776152456436,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 8 attributed commits, 118 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 3 attributed commits, 45 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/issue-641-event-handler-docs'","ref":"e65f24305f2e05780dda4c5b86de2df2752fc09a","url":"https://github.com/neplexlabs/commandkit/commit/e65f24305f2e05780dda4c5b86de2df2752fc09a","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"73b3e1330de3b6e7b8365d082753deae6f0de58d","url":"https://github.com/neplexlabs/commandkit/commit/73b3e1330de3b6e7b8365d082753deae6f0de58d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"746554dadb4863dde5b22f49d20a5480854aac03","url":"https://github.com/neplexlabs/commandkit/commit/746554dadb4863dde5b22f49d20a5480854aac03","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author Copilot","ref":"1393c5e7256bb8c0d0752e8e2591ff52b93b22c7","url":"https://github.com/neplexlabs/commandkit/commit/1393c5e7256bb8c0d0752e8e2591ff52b93b22c7","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author Copilot","ref":"7dffdfd7a9c578ff0d0770c60abccfe68048e124","url":"https://github.com/neplexlabs/commandkit/commit/7dffdfd7a9c578ff0d0770c60abccfe68048e124","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author Copilot","ref":"36604777aef2f22c0612330837520218b49d9a81","url":"https://github.com/neplexlabs/commandkit/commit/36604777aef2f22c0612330837520218b49d9a81","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author Copilot","ref":"a1ed97a3bed94b175e401c676486b7e8e2ff1b3d","url":"https://github.com/neplexlabs/commandkit/commit/a1ed97a3bed94b175e401c676486b7e8e2ff1b3d","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"9d177f4b2d230feadf835dd01b99ec527adb584f","url":"https://github.com/neplexlabs/commandkit/commit/9d177f4b2d230feadf835dd01b99ec527adb584f","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"79953af3a99ea6a4ce0c588c9d49b53199d5e761","url":"https://github.com/neplexlabs/commandkit/commit/79953af3a99ea6a4ce0c588c9d49b53199d5e761","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"ac0b5b05141c16454226ff2a4fb3a7fcdca1bed3","url":"https://github.com/neplexlabs/commandkit/commit/ac0b5b05141c16454226ff2a4fb3a7fcdca1bed3","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"af979e9902014f0588b628b48b5c0c3ece071e28","url":"https://github.com/neplexlabs/commandkit/commit/af979e9902014f0588b628b48b5c0c3ece071e28","weight":0.9}],"data":{"attributed_loc_by_commit":{"af979e9902014f0588b628b48b5c0c3ece071e28":0,"ac0b5b05141c16454226ff2a4fb3a7fcdca1bed3":0,"79953af3a99ea6a4ce0c588c9d49b53199d5e761":62,"9d177f4b2d230feadf835dd01b99ec527adb584f":12,"a1ed97a3bed94b175e401c676486b7e8e2ff1b3d":26,"36604777aef2f22c0612330837520218b49d9a81":16,"7dffdfd7a9c578ff0d0770c60abccfe68048e124":2,"1393c5e7256bb8c0d0752e8e2591ff52b93b22c7":0,"746554dadb4863dde5b22f49d20a5480854aac03":45,"73b3e1330de3b6e7b8365d082753deae6f0de58d":0,"e65f24305f2e05780dda4c5b86de2df2752fc09a":0},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":8,"loc":118,"first_seen":1755396489,"last_seen":1772807191},"openai-codex":{"name":"OpenAI Codex","commits":3,"loc":45,"first_seen":1791686633,"last_seen":1792985942}},"monthly":{"2023-07":{"loc":678,"attributed_loc":0},"2023-08":{"loc":1323,"attributed_loc":0},"2023-09":{"loc":1641,"attributed_loc":0},"2023-10":{"loc":619,"attributed_loc":0},"2023-11":{"loc":1613,"attributed_loc":0},"2023-12":{"loc":307,"attributed_loc":0},"2024-01":{"loc":1096,"attributed_loc":0},"2024-02":{"loc":2630,"attributed_loc":0},"2024-12":{"loc":6837,"attributed_loc":0},"2025-01":{"loc":3320,"attributed_loc":0},"2025-02":{"loc":7650,"attributed_loc":0},"2025-03":{"loc":18043,"attributed_loc":0},"2025-04":{"loc":3210,"attributed_loc":0},"2025-05":{"loc":3272,"attributed_loc":0},"2025-06":{"loc":10406,"attributed_loc":0},"2025-07":{"loc":2913,"attributed_loc":0},"2025-08":{"loc":2547,"attributed_loc":0},"2025-09":{"loc":779,"attributed_loc":0},"2025-10":{"loc":3538,"attributed_loc":74},"2025-11":{"loc":395,"attributed_loc":0},"2025-12":{"loc":2,"attributed_loc":0},"2026-01":{"loc":207,"attributed_loc":42},"2026-02":{"loc":105,"attributed_loc":2},"2026-03":{"loc":6957,"attributed_loc":0},"2026-04":{"loc":4713,"attributed_loc":0},"2026-05":{"loc":0,"attributed_loc":0},"2026-06":{"loc":522,"attributed_loc":0},"2026-07":{"loc":48,"attributed_loc":0},"2026-09":{"loc":256,"attributed_loc":0},"2026-10":{"loc":168,"attributed_loc":45}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1775396995.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1775396995}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":324.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":64804.0,"flagged_loc":9085.0,"flagged_loc_share":0.14019196345904575,"max_loc_per_hour":1010.6910039113429,"median_loc_per_hour":84.68221574344022,"pr_timed_units":17.0,"excluded_import_loc":20991.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,938 lines of first-party code in ~1.9h (1,011 lines/hour, 3 commit session)","ref":"9c01fc3ffb9009f63b7a2a40c1bc707b16a2caa0","url":"https://github.com/neplexlabs/commandkit/commit/9c01fc3ffb9009f63b7a2a40c1bc707b16a2caa0","weight":0.3032073011734029},{"kind":"velocity-burst","description":"2,414 lines of first-party code in ~4.0h (604 lines/hour, 1 commit session)","ref":"855609bc8ce04808dc25146952f6afbbc2fd85ce","url":"https://github.com/neplexlabs/commandkit/commit/855609bc8ce04808dc25146952f6afbbc2fd85ce","weight":0.18105000000000002},{"kind":"velocity-burst","description":"2,216 lines of first-party code in ~4.0h (554 lines/hour, 1 commit session)","ref":"283f9353c9babceaa805a449c1f9116a15bcefe1","url":"https://github.com/neplexlabs/commandkit/commit/283f9353c9babceaa805a449c1f9116a15bcefe1","weight":0.16620000000000001},{"kind":"velocity-burst","description":"2,517 lines of first-party code in ~4.9h (509 lines/hour, 3 commit session)","ref":"3f04de197d870104fab41c4c32afdd1561db202b","url":"https://github.com/neplexlabs/commandkit/commit/3f04de197d870104fab41c4c32afdd1561db202b","weight":0.1526311061201572}],"data":{"flagged_loc_by_commit":{"855609bc8ce04808dc25146952f6afbbc2fd85ce":2414,"283f9353c9babceaa805a449c1f9116a15bcefe1":2216,"fd1fe37c17f9b92649a389d15fae765674afa142":1859,"87b66bd94fa4a4b94c4c8ec84498416b52eb51da":76,"9c01fc3ffb9009f63b7a2a40c1bc707b16a2caa0":3,"75397fe6338cab6ac9c1c5e2bfffd5f8389c797b":2452,"586035d81bbe4e13e3f8eeea21e8183e630c3c2a":3,"3f04de197d870104fab41c4c32afdd1561db202b":62},"excluded_import_commits":["8a8f26967890f07eb79e1776b93477bc479c93e2","8dd881913d870aa606f985ccce4bfd846daaf4c5","f01926219ea1d982eaf2d22049f385df01a39efa","f519cf6537b1007b3c929277314e9783b848899e"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":25.0,"flagged_releases":0.0,"max_loc_per_day":384.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.0.9","to":"v0.0.10","loc":236,"days":19.16,"loc_per_day":12.3,"flagged":false},{"from":"v0.0.10","to":"v0.1.0","loc":535,"days":11.74,"loc_per_day":45.6,"flagged":false},{"from":"v0.1.0","to":"v0.1.1","loc":13,"days":5.24,"loc_per_day":2.5,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":13,"days":5.01,"loc_per_day":2.6,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":145,"days":2.63,"loc_per_day":55.2,"flagged":false},{"from":"v0.1.3","to":"v0.1.4","loc":1294,"days":11.26,"loc_per_day":114.9,"flagged":false},{"from":"v0.1.4","to":"v0.1.5","loc":62,"days":0.7,"loc_per_day":88.3,"flagged":false},{"from":"v0.1.5","to":"v0.1.6","loc":2,"days":0.21,"loc_per_day":9.4,"flagged":false},{"from":"v0.1.6","to":"v0.1.7","loc":2039,"days":69.12,"loc_per_day":29.5,"flagged":false},{"from":"v0.1.7","to":"v0.1.8","loc":41,"days":0.14,"loc_per_day":291.6,"flagged":false},{"from":"v0.1.8","to":"v0.1.9","loc":16,"days":0.04,"loc_per_day":384.0,"flagged":false},{"from":"v0.1.9","to":"v0.1.10","loc":108,"days":1.96,"loc_per_day":55.2,"flagged":false},{"from":"v0.1.10","to":"v1.2.0-rc.5","loc":47447,"days":623.0,"loc_per_day":76.2,"flagged":false},{"from":"v1.2.0-rc.5","to":"v1.2.0-rc.6","loc":4,"days":5.78,"loc_per_day":0.7,"flagged":false},{"from":"v1.2.0-rc.6","to":"v1.2.0-rc.10","loc":301,"days":14.88,"loc_per_day":20.2,"flagged":false},{"from":"v1.2.0-rc.10","to":"v1.2.0-rc.11","loc":474,"days":4.0,"loc_per_day":118.6,"flagged":false},{"from":"v1.2.0-rc.11","to":"v1.2.0-rc.12","loc":543,"days":18.98,"loc_per_day":28.6,"flagged":false},{"from":"v1.2.0-rc.12","to":"v1.2.0","loc":3705,"days":142.07,"loc_per_day":26.1,"flagged":false},{"from":"v1.2.0","to":"v1.2.1","loc":23,"days":7.12,"loc_per_day":3.2,"flagged":false},{"from":"v1.2.1","to":"dev-20260920033200","loc":6030,"days":194.13,"loc_per_day":31.1,"flagged":false},{"from":"dev-20260920033200","to":"v1.2.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.2","to":"v1.2.3","loc":3,"days":20.04,"loc_per_day":0.1,"flagged":false},{"from":"v1.2.3","to":"v1.2.4","loc":95,"days":1.57,"loc_per_day":60.7,"flagged":false},{"from":"v1.2.4","to":"dev-20261013130331","loc":70,"days":2.23,"loc_per_day":31.3,"flagged":false},{"from":"dev-20261013130331","to":"v1.2.6","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":37938.0,"index":0.619,"count:narrated_steps":4.0,"per_kloc:narrated_steps":0.105,"files:narrated_steps":1.0,"count:placeholder":1.0,"per_kloc:placeholder":0.026,"files:placeholder":1.0,"count:emoji_in_code":35.0,"per_kloc:emoji_in_code":0.923,"files:emoji_in_code":12.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:placeholder","description":"placeholder or demo-only phrasing: // Simple delete - in a real scenario, you might want to check ownership","ref":"packages/redis/src/mutex-storage.ts:48","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/redis/src/mutex-storage.ts#L48","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, get the main JSDoc comment text for the member","ref":"scripts/docs/typescript-docs-parser.ts:356","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/scripts/docs/typescript-docs-parser.ts#L356","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Then, add any explicit tags","ref":"scripts/docs/typescript-docs-parser.ts:374","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/scripts/docs/typescript-docs-parser.ts#L374","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, get the main JSDoc comment text (not from tags)","ref":"scripts/docs/typescript-docs-parser.ts:488","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/scripts/docs/typescript-docs-parser.ts#L488","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Then, add any explicit @description tags and examples","ref":"scripts/docs/typescript-docs-parser.ts:506","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/scripts/docs/typescript-docs-parser.ts#L506","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"apps/website/docusaurus.config.ts","line":115,"fingerprint":"apps/website/docusaurus.config.ts:generic-api-key:115"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":91.0,"findings_high":0.0,"findings_medium":91.0,"findings_low":0.0,"weighted_findings":23.45,"scanned_lines":37902.0,"parse_errors":7.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"apps/test-bot/src/app/commands/remind.ts","line":43,"fingerprint":"javascript.lang.security.html-in-template-string:apps/test-bot/src/app/commands/remind.ts:43"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"apps/test-bot/src/app/commands/remind.ts","line":64,"fingerprint":"javascript.lang.security.html-in-template-string:apps/test-bot/src/app/commands/remind.ts:64"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"apps/test-bot/src/app/tasks/remind.ts","line":23,"fingerprint":"javascript.lang.security.html-in-template-string:apps/test-bot/src/app/tasks/remind.ts:23"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"apps/website/docusaurus.config.ts","line":164,"fingerprint":"javascript.lang.security.html-in-template-string:apps/website/docusaurus.config.ts:164"},{"rule_id":"opengrep/typescript.react.security.audit.react-dangerouslysetinnerhtml","severity":"medium","message":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT [confidence medium]","path":"apps/website/src/components/MemberInfo/index.tsx","line":36,"fingerprint":"typescript.react.security.audit.react-dangerouslysetinnerhtml:apps/website/src/components/MemberInfo/index.tsx:36"},{"rule_id":"opengrep/typescript.react.security.audit.react-dangerouslysetinnerhtml","severity":"medium","message":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT [confidence medium]","path":"apps/website/src/components/MemberInfo/index.tsx","line":44,"fingerprint":"typescript.react.security.audit.react-dangerouslysetinnerhtml:apps/website/src/components/MemberInfo/index.tsx:44"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":31,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:apps/website/src/plugins/llms-txt.js:31"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":32,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:apps/website/src/plugins/llms-txt.js:32"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":33,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:apps/website/src/plugins/llms-txt.js:33"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:apps/website/src/plugins/llms-txt.js:37"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":43,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:apps/website/src/plugins/llms-txt.js:43"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":46,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:apps/website/src/plugins/llms-txt.js:46"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":46,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:apps/website/src/plugins/llms-txt.js:46"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":53,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:apps/website/src/plugins/llms-txt.js:53"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `context` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":75,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:apps/website/src/plugins/llms-txt.js:75"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":95,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:apps/website/src/plugins/llms-txt.js:95"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ content, outDir }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"apps/website/src/plugins/llms-txt.js","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:apps/website/src/plugins/llms-txt.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/commandkit/src/app/commands/AppCommandRunner.ts","line":143,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/commandkit/src/app/commands/AppCommandRunner.ts:143"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/commandkit/src/app/commands/Context.ts","line":395,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/commandkit/src/app/commands/Context.ts:395"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/development.ts","line":78,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/development.ts:78"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":116,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:116"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":117,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":117,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":124,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:124"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":124,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:124"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":124,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:124"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":124,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:124"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":132,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:132"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":132,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:132"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":132,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:132"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":132,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:132"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":146,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:146"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":146,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:146"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":147,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:147"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":147,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:147"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":147,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:147"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":147,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:147"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":154,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:154"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":154,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:154"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":154,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:154"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":155,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:155"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":155,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:155"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `customPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":163,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:163"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":163,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/generators.ts:163"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":163,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:163"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/cli/generators.ts","line":163,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/cli/generators.ts:163"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"packages/commandkit/src/cli/information.ts","line":63,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:packages/commandkit/src/cli/information.ts:63"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `configPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/commandkit/src/cli/production.ts","line":20,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/commandkit/src/cli/production.ts:20"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"packages/commandkit/src/kv/dotprops.ts","line":9,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:packages/commandkit/src/kv/dotprops.ts:9"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"packages/commandkit/src/kv/dotprops.ts","line":24,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:packages/commandkit/src/kv/dotprops.ts:24"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `serialized` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-cont [confidence low]","path":"packages/commandkit/src/kv/serde.ts","line":93,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/commandkit/src/kv/serde.ts:93"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/commandkit/src/logger/DefaultLogger.ts","line":126,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/commandkit/src/logger/DefaultLogger.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/commandkit/src/logger/DefaultLogger.ts","line":141,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/commandkit/src/logger/DefaultLogger.ts:141"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/commandkit/src/logger/DefaultLogger.ts","line":168,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/commandkit/src/logger/DefaultLogger.ts:168"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/commandkit/src/utils/resolve-file-url.ts","line":10,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/commandkit/src/utils/resolve-file-url.ts:10"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/commandkit/src/utils/types-package.ts","line":24,"fingerprint":"javascript.lang.security.html-in-template-string:packages/commandkit/src/utils/types-package.ts:24"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/i18n/src/cli.ts","line":57,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/i18n/src/cli.ts:57"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/i18n/src/cli.ts","line":61,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/i18n/src/cli.ts:61"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/i18n/src/cli.ts","line":63,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/i18n/src/cli.ts:63"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/i18n/src/cli.ts","line":69,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/i18n/src/cli.ts:69"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/i18n/src/cli.ts","line":71,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/i18n/src/cli.ts:71"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/i18n/src/cli.ts","line":72,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/i18n/src/cli.ts:72"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/i18n/src/cli.ts","line":82,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/i18n/src/cli.ts:82"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/i18n/src/i18n.ts","line":220,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/i18n/src/i18n.ts:220"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/i18n/src/i18n.ts","line":220,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/i18n/src/i18n.ts:220"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/i18n/src/i18n.ts","line":331,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/i18n/src/i18n.ts:331"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/legacy/src/cli.ts","line":93,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/legacy/src/cli.ts:93"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/legacy/src/cli.ts","line":96,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/legacy/src/cli.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/legacy/src/cli.ts","line":100,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/legacy/src/cli.ts:100"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/legacy/src/cli.ts","line":112,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/legacy/src/cli.ts:112"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/legacy/src/cli.ts","line":115,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/legacy/src/cli.ts:115"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/legacy/src/cli.ts","line":116,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/legacy/src/cli.ts:116"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/legacy/src/cli.ts","line":121,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/legacy/src/cli.ts:121"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/legacy/src/cli.ts","line":126,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/legacy/src/cli.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/legacy/src/cli.ts","line":126,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/legacy/src/cli.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/legacy/src/cli.ts","line":129,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/legacy/src/cli.ts:129"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/ratelimit/src/plugin.ts","line":611,"fingerprint":"javascript.lang.security.html-in-template-string:packages/ratelimit/src/plugin.ts:611"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `glob` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"packages/ratelimit/src/storage/memory.ts","line":354,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/ratelimit/src/storage/memory.ts:354"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/docs/docgen-utils.ts","line":58,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/docs/docgen-utils.ts:58"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/docs/docgen-utils.ts","line":65,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/docs/docgen-utils.ts:65"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/docs/docgen-utils.ts","line":67,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/docs/docgen-utils.ts:67"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/docs/generate-typescript-docs.ts","line":161,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/docs/generate-typescript-docs.ts:161"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/docs/generate-typescript-docs.ts","line":171,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/docs/generate-typescript-docs.ts:171"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/docs/typescript-docs-parser.ts","line":44,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/docs/typescript-docs-parser.ts:44"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/docs/typescript-docs-renderer.ts","line":480,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/docs/typescript-docs-renderer.ts:480"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/docs/typescript-docs-renderer.ts","line":524,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/docs/typescript-docs-renderer.ts:524"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/docs/typescript-docs-renderer.ts","line":545,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/docs/typescript-docs-renderer.ts:545"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/docs/typescript-docs-renderer.ts","line":567,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/docs/typescript-docs-renderer.ts:567"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/docs/typescript-docs-renderer.ts","line":586,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/docs/typescript-docs-renderer.ts:586"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/docs/typescript-docs-renderer.ts","line":590,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/docs/typescript-docs-renderer.ts:590"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/docs/typescript-docs-renderer.ts","line":612,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/docs/typescript-docs-renderer.ts:612"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":26.0,"vulnerabilities":62.0,"vulns_critical":3.0,"vulns_high":23.0,"vulns_medium":28.0,"vulns_low":7.0,"vulns_unknown":1.0,"penalty":165.0},"findings":[{"rule_id":"osv/GHSA-cg2g-xh64-v4q7","severity":"critical","message":"dompurify@3.4.16 (npm) is affected by GHSA-cg2g-xh64-v4q7","path":"pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.16 (npm):GHSA-cg2g-xh64-v4q7"},{"rule_id":"osv/GHSA-5gmw-xhrv-c9v3","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3","path":"pnpm-lock.yaml","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-5gmw-xhrv-c9v3"},{"rule_id":"osv/GHSA-85c8-ppgw-ccpr","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr","path":"pnpm-lock.yaml","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-85c8-ppgw-ccpr"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@1.20.8 (npm) is affected by GHSA-27r3-jxmh-p828","path":"pnpm-lock.yaml","line":null,"fingerprint":"body-parser@1.20.8 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-j22f-vq7h-c4qm","severity":"high","message":"devalue@5.9.2 (npm) is affected by GHSA-j22f-vq7h-c4qm","path":"pnpm-lock.yaml","line":null,"fingerprint":"devalue@5.9.2 (npm):GHSA-j22f-vq7h-c4qm"},{"rule_id":"osv/GHSA-mcm9-63f2-9j32","severity":"high","message":"devalue@5.9.2 (npm) is affected by GHSA-mcm9-63f2-9j32","path":"pnpm-lock.yaml","line":null,"fingerprint":"devalue@5.9.2 (npm):GHSA-mcm9-63f2-9j32"},{"rule_id":"osv/GHSA-r9w8-h9r3-54w4","severity":"high","message":"devalue@5.9.2 (npm) is affected by GHSA-r9w8-h9r3-54w4","path":"pnpm-lock.yaml","line":null,"fingerprint":"devalue@5.9.2 (npm):GHSA-r9w8-h9r3-54w4"},{"rule_id":"osv/GHSA-x5rw-q4pp-hg5g","severity":"high","message":"devalue@5.9.2 (npm) is affected by GHSA-x5rw-q4pp-hg5g","path":"pnpm-lock.yaml","line":null,"fingerprint":"devalue@5.9.2 (npm):GHSA-x5rw-q4pp-hg5g"},{"rule_id":"osv/GHSA-mrv2-3pqr-j5jr","severity":"high","message":"dompurify@3.4.16 (npm) is affected by GHSA-mrv2-3pqr-j5jr","path":"pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.16 (npm):GHSA-mrv2-3pqr-j5jr"},{"rule_id":"osv/GHSA-mrwp-f3q8-3g9p","severity":"high","message":"follow-redirects@1.16.1 (npm) is affected by GHSA-mrwp-f3q8-3g9p","path":"pnpm-lock.yaml","line":null,"fingerprint":"follow-redirects@1.16.1 (npm):GHSA-mrwp-f3q8-3g9p"},{"rule_id":"osv/GHSA-4528-x5fx-h6hg","severity":"high","message":"joi@17.13.8 (npm) is affected by GHSA-4528-x5fx-h6hg","path":"pnpm-lock.yaml","line":null,"fingerprint":"joi@17.13.8 (npm):GHSA-4528-x5fx-h6hg"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@5.1.6 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@5.1.6 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@5.1.6 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"pnpm-lock.yaml","line":null,"fingerprint":"nanoid@5.1.6 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-5c6j-r48x-rmvq","severity":"high","message":"serialize-javascript@6.0.2 (npm) is affected by GHSA-5c6j-r48x-rmvq","path":"pnpm-lock.yaml","line":null,"fingerprint":"serialize-javascript@6.0.2 (npm):GHSA-5c6j-r48x-rmvq"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@6.29.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@6.29.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@6.29.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@6.29.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@6.29.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@6.29.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.30.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.30.0 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.30.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.30.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@8.3.2 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"pnpm-lock.yaml","line":null,"fingerprint":"uuid@8.3.2 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.1.5 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.5 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.1.11 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"pnpm-lock.yaml","line":null,"fingerprint":"zod@4.1.11 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.5.4 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"pnpm-lock.yaml","line":null,"fingerprint":"zod@4.5.4 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.6.5 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"pnpm-lock.yaml","line":null,"fingerprint":"zod@4.6.5 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@2.1.4 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"pnpm-lock.yaml","line":null,"fingerprint":"@hono/node-server@2.1.4 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-qv5m-9pm6-hqp3","severity":"medium","message":"@hono/node-server@2.1.4 (npm) is affected by GHSA-qv5m-9pm6-hqp3","path":"pnpm-lock.yaml","line":null,"fingerprint":"@hono/node-server@2.1.4 (npm):GHSA-qv5m-9pm6-hqp3"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.11 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"pnpm-lock.yaml","line":null,"fingerprint":"@vitest/mocker@4.1.11 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-xp26-3454-mjgp","severity":"medium","message":"@vitest/mocker@4.1.11 (npm) is affected by GHSA-xp26-3454-mjgp","path":"pnpm-lock.yaml","line":null,"fingerprint":"@vitest/mocker@4.1.11 (npm):GHSA-xp26-3454-mjgp"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"pnpm-lock.yaml","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-4q55-j62x-fr9h","severity":"medium","message":"devalue@5.9.2 (npm) is affected by GHSA-4q55-j62x-fr9h","path":"pnpm-lock.yaml","line":null,"fingerprint":"devalue@5.9.2 (npm):GHSA-4q55-j62x-fr9h"},{"rule_id":"osv/GHSA-hx4r-w6wj-j8fg","severity":"medium","message":"devalue@5.9.2 (npm) is affected by GHSA-hx4r-w6wj-j8fg","path":"pnpm-lock.yaml","line":null,"fingerprint":"devalue@5.9.2 (npm):GHSA-hx4r-w6wj-j8fg"},{"rule_id":"osv/GHSA-c6gr-qvv4-5v3f","severity":"medium","message":"dompurify@3.4.16 (npm) is affected by GHSA-c6gr-qvv4-5v3f","path":"pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.16 (npm):GHSA-c6gr-qvv4-5v3f"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-wjr9-j795-jxcr","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@13.0.6 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"pnpm-lock.yaml","line":null,"fingerprint":"glob@13.0.6 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.13.13 (npm) is affected by GHSA-46wx-v44x-9hh2","path":"pnpm-lock.yaml","line":null,"fingerprint":"hono@4.13.13 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.13.13 (npm) is affected by GHSA-4h7h-rv7c-7m2v","path":"pnpm-lock.yaml","line":null,"fingerprint":"hono@4.13.13 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.13.13 (npm) is affected by GHSA-4m76-xfj5-7975","path":"pnpm-lock.yaml","line":null,"fingerprint":"hono@4.13.13 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.13.13 (npm) is affected by GHSA-h7mg-cq63-vhpq","path":"pnpm-lock.yaml","line":null,"fingerprint":"hono@4.13.13 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@6.1.4 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"pnpm-lock.yaml","line":null,"fingerprint":"postcss-selector-parser@6.1.4 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.16.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"pnpm-lock.yaml","line":null,"fingerprint":"qs@6.16.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-qj8w-gfj5-8c6v","severity":"medium","message":"serialize-javascript@6.0.2 (npm) is affected by GHSA-qj8w-gfj5-8c6v","path":"pnpm-lock.yaml","line":null,"fingerprint":"serialize-javascript@6.0.2 (npm):GHSA-qj8w-gfj5-8c6v"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@6.29.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@6.29.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@6.29.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@6.29.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.30.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.30.0 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.30.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.30.0 (npm) is affected by GHSA-f72v-6w45-q472","path":"pnpm-lock.yaml","line":null,"fingerprint":"undici@7.30.0 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.1.5 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.5 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.1.5 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.5 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.1.5 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.5 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-wf3x-273g-mvxv","severity":"low","message":"devalue@5.9.2 (npm) is affected by GHSA-wf3x-273g-mvxv","path":"pnpm-lock.yaml","line":null,"fingerprint":"devalue@5.9.2 (npm):GHSA-wf3x-273g-mvxv"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-333x-w4r6-6crp","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.13.13 (npm) is affected by GHSA-3gg2-335m-rxc6","path":"pnpm-lock.yaml","line":null,"fingerprint":"hono@4.13.13 (npm):GHSA-3gg2-335m-rxc6"},{"rule_id":"osv/GHSA-238p-pmpm-9mq7","severity":"low","message":"katex@0.16.47 (npm) is affected by GHSA-238p-pmpm-9mq7","path":"pnpm-lock.yaml","line":null,"fingerprint":"katex@0.16.47 (npm):GHSA-238p-pmpm-9mq7"},{"rule_id":"osv/GHSA-m5mm-p8h7-m29v","severity":"low","message":"serialize-javascript@6.0.2 (npm) is affected by GHSA-m5mm-p8h7-m29v","path":"pnpm-lock.yaml","line":null,"fingerprint":"serialize-javascript@6.0.2 (npm):GHSA-m5mm-p8h7-m29v"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.1.5 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.5 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":20.0,"findings_high":15.0,"findings_medium":4.0,"findings_low":1.0,"penalty":177.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/code-quality.yaml","line":15,"fingerprint":"unpinned-uses:.github/workflows/code-quality.yaml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/code-quality.yaml","line":19,"fingerprint":"unpinned-uses:.github/workflows/code-quality.yaml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/code-quality.yaml","line":21,"fingerprint":"unpinned-uses:.github/workflows/code-quality.yaml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish-latest.yaml","line":21,"fingerprint":"unpinned-uses:.github/workflows/publish-latest.yaml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish-latest.yaml","line":25,"fingerprint":"unpinned-uses:.github/workflows/publish-latest.yaml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish-latest.yaml","line":29,"fingerprint":"unpinned-uses:.github/workflows/publish-latest.yaml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish-latest.yaml","line":255,"fingerprint":"unpinned-uses:.github/workflows/publish-latest.yaml:255"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish-latest.yaml","line":29,"fingerprint":"cache-poisoning:.github/workflows/publish-latest.yaml:29"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/publish-rc.yaml","line":38,"fingerprint":"template-injection:.github/workflows/publish-rc.yaml:38"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/publish-rc.yaml","line":45,"fingerprint":"template-injection:.github/workflows/publish-rc.yaml:45"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/publish-rc.yaml","line":141,"fingerprint":"template-injection:.github/workflows/publish-rc.yaml:141"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/publish-rc.yaml","line":143,"fingerprint":"template-injection:.github/workflows/publish-rc.yaml:143"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish-rc.yaml","line":21,"fingerprint":"unpinned-uses:.github/workflows/publish-rc.yaml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish-rc.yaml","line":25,"fingerprint":"unpinned-uses:.github/workflows/publish-rc.yaml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish-rc.yaml","line":27,"fingerprint":"unpinned-uses:.github/workflows/publish-rc.yaml:27"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/code-quality.yaml","line":19,"fingerprint":"artipacked:.github/workflows/code-quality.yaml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/code-quality.yaml","line":10,"fingerprint":"excessive-permissions:.github/workflows/code-quality.yaml:10"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish-latest.yaml","line":25,"fingerprint":"artipacked:.github/workflows/publish-latest.yaml:25"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish-rc.yaml","line":25,"fingerprint":"artipacked:.github/workflows/publish-rc.yaml:25"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/publish-latest.yaml","line":255,"fingerprint":"superfluous-actions:.github/workflows/publish-latest.yaml:255"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":1.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.305,"unpinned_manifests":15.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"Dependency updates: renovate.json","ref":"renovate.json","url":null,"weight":0.0},{"kind":"posture","description":"apps/test-bot/package.json has no lockfile alongside it (unpinned dependencies)","ref":"apps/test-bot/package.json","url":null,"weight":0.3},{"kind":"posture","description":"apps/website/package.json has no lockfile alongside it (unpinned dependencies)","ref":"apps/website/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/ai/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/ai/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/analytics/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/analytics/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/cache/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/cache/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/commandkit/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/commandkit/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/create-commandkit/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/create-commandkit/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/i18n/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/i18n/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/legacy/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/legacy/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/queue/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/queue/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/ratelimit/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/ratelimit/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/redis/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/redis/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/tasks/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/tasks/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/tsconfig/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/tsconfig/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/workflow/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/workflow/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1906.0,"function_nloc":18973.0,"mean_ccn":2.58,"p90_ccn":6.0,"complex_functions":21.0,"long_functions":9.0,"many_param_functions":0.0,"risky_nloc_share":0.1097},"findings":[],"evidence":[{"kind":"complex-function","description":"traverseDirectory in packages/commandkit/src/app/router/CommandsRouter.ts: complexity 39, 200 lines","ref":"packages/commandkit/src/app/router/CommandsRouter.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/commandkit/src/app/router/CommandsRouter.ts#L502","weight":0.65},{"kind":"complex-function","description":"beforeExecute in packages/commandkit/src/app/middlewares/permissions.ts: complexity 38, 117 lines","ref":"packages/commandkit/src/app/middlewares/permissions.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/commandkit/src/app/middlewares/permissions.ts#L13","weight":0.6333333333333333},{"kind":"complex-function","description":"executeCommand in packages/ratelimit/src/plugin.ts: complexity 37, 206 lines","ref":"packages/ratelimit/src/plugin.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/ratelimit/src/plugin.ts#L136","weight":0.6166666666666667},{"kind":"complex-function","description":"prepareCommandRun in packages/commandkit/src/app/handlers/AppCommandHandler.ts: complexity 35, 113 lines","ref":"packages/commandkit/src/app/handlers/AppCommandHandler.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/commandkit/src/app/handlers/AppCommandHandler.ts#L670","weight":0.5833333333333334},{"kind":"complex-function","description":"parseMembers in scripts/docs/typescript-docs-parser.ts: complexity 29, 106 lines","ref":"scripts/docs/typescript-docs-parser.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/scripts/docs/typescript-docs-parser.ts#L301","weight":0.48333333333333334},{"kind":"complex-function","description":"(anonymous) in packages/ratelimit/src/engine/algorithms/fixed-window.ts: complexity 25, 97 lines","ref":"packages/ratelimit/src/engine/algorithms/fixed-window.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/ratelimit/src/engine/algorithms/fixed-window.ts#L100","weight":0.4166666666666667},{"kind":"complex-function","description":"main in packages/create-commandkit/src/index.ts: complexity 23, 186 lines","ref":"packages/create-commandkit/src/index.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/create-commandkit/src/index.ts#L26","weight":0.38333333333333336},{"kind":"complex-function","description":"processCommandFile in packages/commandkit/src/app/handlers/AppCommandHandler.ts: complexity 22, 88 lines","ref":"packages/commandkit/src/app/handlers/AppCommandHandler.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/commandkit/src/app/handlers/AppCommandHandler.ts#L1129","weight":0.36666666666666664},{"kind":"complex-function","description":"render in scripts/docs/typescript-docs-renderer.ts: complexity 22, 130 lines","ref":"scripts/docs/typescript-docs-renderer.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/scripts/docs/typescript-docs-renderer.ts#L31","weight":0.36666666666666664},{"kind":"complex-function","description":"buildApplication in packages/commandkit/src/cli/build.ts: complexity 21, 102 lines","ref":"packages/commandkit/src/cli/build.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/packages/commandkit/src/cli/build.ts#L69","weight":0.35}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":23816.0,"duplicated_lines":2164.0,"duplicated_share":0.0909,"files":424.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/(developer)/+middleware.ts:10 and apps/test-bot/src/app/commands/(interactions)/+middleware.ts:10","ref":"apps/test-bot/src/app/commands/(developer)/+middleware.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/(developer)/+middleware.ts#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/(general)/avatar.ts:32 and apps/test-bot/src/app/commands/(general)/avatar.ts:52","ref":"apps/test-bot/src/app/commands/(general)/avatar.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/(general)/avatar.ts#L32","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/(general)/components.tsx:16 and apps/test-bot/src/app/commands/(interactions)/commandkit.tsx:21","ref":"apps/test-bot/src/app/commands/(general)/components.tsx","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/(general)/components.tsx#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/(general)/components.tsx:38 and apps/test-bot/src/app/commands/(select menu)/select-channel.tsx:14","ref":"apps/test-bot/src/app/commands/(general)/components.tsx","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/(general)/components.tsx#L38","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/(interactions)/confirmation.tsx:45 and apps/test-bot/src/app/commands/(interactions)/confirmation.tsx:65","ref":"apps/test-bot/src/app/commands/(interactions)/confirmation.tsx","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/(interactions)/confirmation.tsx#L45","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/(select menu)/select-channel.tsx:20 and apps/test-bot/src/app/commands/(select menu)/select-role.tsx:20","ref":"apps/test-bot/src/app/commands/(select menu)/select-channel.tsx","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/(select menu)/select-channel.tsx#L20","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/(select menu)/select-string-multi.tsx:2 and apps/test-bot/src/app/commands/(select menu)/select-string.tsx:2","ref":"apps/test-bot/src/app/commands/(select menu)/select-string-multi.tsx","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/(select menu)/select-string-multi.tsx#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/commands/greet.ts:5 and examples/with-workflow/src/app/commands/greet.ts:5","ref":"apps/test-bot/src/app/commands/greet.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/commands/greet.ts#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/app/events/(ratelimits)/ratelimited/logger.ts:13 and packages/ratelimit/src/plugin.ts:53","ref":"apps/test-bot/src/app/events/(ratelimits)/ratelimited/logger.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/app/events/(ratelimits)/ratelimited/logger.ts#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: apps/test-bot/src/workflows/greet/greet.workflow.ts:4 and examples/with-workflow/src/workflows/greet/greet.workflow.ts:4","ref":"apps/test-bot/src/workflows/greet/greet.workflow.ts","url":"https://github.com/neplexlabs/commandkit/blob/e65f24305f2e05780dda4c5b86de2df2752fc09a/apps/test-bot/src/workflows/greet/greet.workflow.ts#L4","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":65.0,"weighted_findings":32.5,"scanned_lines":37902.0,"category:best-practice":14.0,"category:correctness":51.0},"findings":[{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how node.kind === 'command' is evaluated, this expression returns ''. This is probably a copy-paste error.","path":"packages/commandkit/src/app/handlers/AppCommandHandler.ts","line":374,"fingerprint":"typescript.lang.correctness.useless-ternary:packages/commandkit/src/app/handlers/AppCommandHandler.ts:374"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"apps/test-bot/src/app/commands/(general)/help.ts","line":13,"fingerprint":"javascript.lang.best-practice.lazy-load-module:apps/test-bot/src/app/commands/(general)/help.ts:13"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"apps/test-bot/src/app/commands/(general)/help.ts","line":15,"fingerprint":"javascript.lang.best-practice.lazy-load-module:apps/test-bot/src/app/commands/(general)/help.ts:15"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"apps/website/docusaurus.config.ts","line":197,"fingerprint":"javascript.lang.best-practice.lazy-load-module:apps/website/docusaurus.config.ts:197"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"apps/website/docusaurus.config.ts","line":198,"fingerprint":"javascript.lang.best-practice.lazy-load-module:apps/website/docusaurus.config.ts:198"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"apps/website/docusaurus.config.ts","line":199,"fingerprint":"javascript.lang.best-practice.lazy-load-module:apps/website/docusaurus.config.ts:199"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/website/src/components/home/FeaturesSection.tsx","line":76,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/website/src/components/home/FeaturesSection.tsx:76"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"apps/website/src/plugins/tailwind-config.js","line":5,"fingerprint":"javascript.lang.best-practice.lazy-load-module:apps/website/src/plugins/tailwind-config.js:5"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"apps/website/src/theme/DocVersionBanner/index.tsx","line":143,"fingerprint":"typescript.react.best-practice.react-props-spreading:apps/website/src/theme/DocVersionBanner/index.tsx:143"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/commandkit/src/cli/development.ts","line":46,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/commandkit/src/cli/development.ts:46"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/commandkit/src/cli/development.ts","line":53,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/commandkit/src/cli/development.ts:53"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"packages/commandkit/src/cli/information.ts","line":25,"fingerprint":"javascript.lang.best-practice.lazy-load-module:packages/commandkit/src/cli/information.ts:25"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"packages/commandkit/src/cli/information.ts","line":26,"fingerprint":"javascript.lang.best-practice.lazy-load-module:packages/commandkit/src/cli/information.ts:26"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"packages/commandkit/src/cli/information.ts","line":63,"fingerprint":"javascript.lang.best-practice.lazy-load-module:packages/commandkit/src/cli/information.ts:63"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"packages/commandkit/src/version.ts","line":6,"fingerprint":"javascript.lang.best-practice.lazy-load-module:packages/commandkit/src/version.ts:6"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"packages/create-commandkit/src/index.ts","line":151,"fingerprint":"javascript.lang.best-practice.javascript-confirm:packages/create-commandkit/src/index.ts:151"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"packages/tasks/src/plugin.ts","line":87,"fingerprint":"javascript.lang.best-practice.lazy-load-module:packages/tasks/src/plugin.ts:87"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/docs/docgen-utils.ts","line":101,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/docs/docgen-utils.ts:101"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/docs/docgen-utils.ts","line":102,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/docs/docgen-utils.ts:102"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ai/src/cli-plugin.ts","line":5,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ai/src/cli-plugin.ts:5"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ai/src/cli-plugin.ts","line":5,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ai/src/cli-plugin.ts:5"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"packages/commandkit/analytics.cjs","line":1,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/analytics.cjs:1"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"packages/commandkit/analytics.cjs","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/analytics.cjs:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"packages/commandkit/analytics.cjs","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/analytics.cjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"packages/commandkit/config.cjs","line":1,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/config.cjs:1"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"packages/commandkit/hooks.cjs","line":1,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/hooks.cjs:1"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"packages/commandkit/logger.cjs","line":1,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/logger.cjs:1"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"packages/commandkit/logger.cjs","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/logger.cjs:2"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/build.ts","line":279,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/build.ts:279"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`ps` is assigned twice; the first assignment is useless","path":"packages/commandkit/src/cli/development.ts","line":230,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/src/cli/development.ts:230"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":59,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:59"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":66,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:66"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":84,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:84"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/cli/generators.ts","line":84,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/cli/generators.ts:84"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`defined` is assigned twice; the first assignment is useless","path":"packages/commandkit/src/config/config.ts","line":23,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/commandkit/src/config/config.ts:23"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/utils/types-package.ts","line":38,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/utils/types-package.ts:38"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/commandkit/src/utils/types-package.ts","line":38,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/commandkit/src/utils/types-package.ts:38"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/legacy/src/cli.ts","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/legacy/src/cli.ts:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/legacy/src/cli.ts","line":45,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/legacy/src/cli.ts:45"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/legacy/src/cli.ts","line":49,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/legacy/src/cli.ts:49"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/legacy/src/cli.ts","line":58,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/legacy/src/cli.ts:58"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/legacy/src/cli.ts","line":58,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/legacy/src/cli.ts:58"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/legacy/src/cli.ts","line":63,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/legacy/src/cli.ts:63"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ratelimit/src/storage/redis.ts","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ratelimit/src/storage/redis.ts:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ratelimit/src/storage/redis.ts","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ratelimit/src/storage/redis.ts:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ratelimit/src/storage/redis.ts","line":26,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ratelimit/src/storage/redis.ts:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/ratelimit/src/storage/redis.ts","line":26,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/ratelimit/src/storage/redis.ts:26"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-ai/tools/generate-ai-command-template.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-ai/tools/generate-ai-command-template.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-ai/tools/generate-ai-command-template.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-ai/tools/generate-ai-command-template.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-plugin-development/tools/generate-compiler-plugin-template.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-plugin-development/tools/generate-compiler-plugin-template.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-plugin-development/tools/generate-compiler-plugin-template.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-plugin-development/tools/generate-compiler-plugin-template.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-plugin-development/tools/generate-runtime-plugin-template.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-plugin-development/tools/generate-runtime-plugin-template.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-plugin-development/tools/generate-runtime-plugin-template.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-plugin-development/tools/generate-runtime-plugin-template.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-ratelimit/tools/generate-ratelimit-config.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-ratelimit/tools/generate-ratelimit-config.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-ratelimit/tools/generate-ratelimit-config.mjs","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-ratelimit/tools/generate-ratelimit-config.mjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-tasks/tools/generate-task-template.mjs","line":6,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-tasks/tools/generate-task-template.mjs:6"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-tasks/tools/generate-task-template.mjs","line":6,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-tasks/tools/generate-task-template.mjs:6"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-tasks/tools/generate-task-template.mjs","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-tasks/tools/generate-task-template.mjs:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"skills/commandkit-tasks/tools/generate-task-template.mjs","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:skills/commandkit-tasks/tools/generate-task-template.mjs:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"turbo/generators/config.ts","line":27,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:turbo/generators/config.ts:27"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"turbo/generators/config.ts","line":27,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:turbo/generators/config.ts:27"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1962,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":0.2941,"test_lines":3721.0,"source_lines":37938.0,"test_ratio":0.0981,"ci_files":3.0,"cochange_share":0.0735,"cochange_commits":136.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/code-quality.yaml","ref":".github/workflows/code-quality.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/publish-latest.yaml","ref":".github/workflows/publish-latest.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/publish-rc.yaml","ref":".github/workflows/publish-rc.yaml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm run test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (prettier)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm run test"],"lint_commands":["prettier"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":26.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":189.0,"escapes_per_kloc":5.085},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: apps/test-bot/tsconfig.json","ref":"apps/test-bot/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":159.0,"other_lines":37779.0,"files_blamed":424.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":65.0,"quality:other_per_kloc":1.721,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":92.0,"security:other_per_kloc":2.435},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}