{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.700829Z","repo":{"ref":{"host":"github.com","owner":"nreed97","name":"EzFD"},"default_branch":"master","clone_url":"https://github.com/nreed97/EzFD.git","html_url":"https://github.com/nreed97/EzFD","description":"Real-time multi-op ARRL Field Day logger — web-based logger with offline support, band activity, map, ADIF/Cabrillo export","stars":4,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":11237,"primary_language":"TypeScript","license_spdx":"NOASSERTION","created_at":"2026-06-28T01:52:48Z","pushed_at":"2026-11-13T04:53:20Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-04-03T00:49:04Z","owner_type":"User","release_assets":[]}},"commit_sha":"72083165c9b33312033df3af08970cdafbf00a4d","profile":{"lines_by_language":{"TypeScript":17982,"JavaScript":7026,"Shell":3867,"Python":1710,"SQL":1179},"files_by_category":{"source":148,"docs":24,"config":15,"binary":15,"other":5,"oversized":3,"generated":1},"source_lines":31764,"test_lines":0},"pillars":{"ai_provenance":{"score":99.7,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.9966,"suspected_share":0.0034,"estimated_share":0.9966,"ai_artifacts":2.0,"flagged_work_units":5.0,"flagged_releases":null,"style_index":0.11},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":52.3,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":35.7,"duplication":61.4,"lint":75.1,"testing":25.0,"docs":85.0,"type_safety":94.8,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 34% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing."},"security":{"score":70.4,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":73.7,"dependencies":83.2,"ci_actions":6.3,"posture":60.0,"scorecard":null},"summary":"Security posture is adequate: 2 known vulnerabilities in 2 dependencies; 12 high-severity SAST findings; 12 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":25.0,"checked":25.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":227.0,"attributed_commits":220.0,"attributed_commit_share":0.9691629955947136,"effective_loc":38008.0,"attributed_loc":37878.0,"attributed_loc_share":0.9965796674384341,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 220 attributed commits, 37,878 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"01f4d87678626b89a929adf1a896ea944bddb1ef","url":"https://github.com/nreed97/EzFD/commit/01f4d87678626b89a929adf1a896ea944bddb1ef","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"41d51dfc989a228b93d676273f9ee99dffb28b6f","url":"https://github.com/nreed97/EzFD/commit/41d51dfc989a228b93d676273f9ee99dffb28b6f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"ac59fe84d747f8dd3c2ee449a5f1fa3df4a92704","url":"https://github.com/nreed97/EzFD/commit/ac59fe84d747f8dd3c2ee449a5f1fa3df4a92704","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"5f2bbf3fe342829efbb3b2831effb8497b8a6e89","url":"https://github.com/nreed97/EzFD/commit/5f2bbf3fe342829efbb3b2831effb8497b8a6e89","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"f0be4418a9dcc73e2820d563a496ee0470dff8c4","url":"https://github.com/nreed97/EzFD/commit/f0be4418a9dcc73e2820d563a496ee0470dff8c4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"c854e2d213c6a1df4324889149179f51cc74c53e","url":"https://github.com/nreed97/EzFD/commit/c854e2d213c6a1df4324889149179f51cc74c53e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"076dd86586e522ef7ebc729e8e1a1acd6634c172","url":"https://github.com/nreed97/EzFD/commit/076dd86586e522ef7ebc729e8e1a1acd6634c172","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"17a11902cdaa45c16623d4c00e448cb2488a391c","url":"https://github.com/nreed97/EzFD/commit/17a11902cdaa45c16623d4c00e448cb2488a391c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"955d4191df4cc38ba3d43dbb55e4dfec15e664fb","url":"https://github.com/nreed97/EzFD/commit/955d4191df4cc38ba3d43dbb55e4dfec15e664fb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"9fb502dcf1a9aba3d69d5c440149eab0aa1610c0","url":"https://github.com/nreed97/EzFD/commit/9fb502dcf1a9aba3d69d5c440149eab0aa1610c0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"dd52704ab6e9f200bcd58bc51f5f3168bc5c9cf4","url":"https://github.com/nreed97/EzFD/commit/dd52704ab6e9f200bcd58bc51f5f3168bc5c9cf4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"36b2225d2a8d878fa09f8e567a9b74eb3739681f","url":"https://github.com/nreed97/EzFD/commit/36b2225d2a8d878fa09f8e567a9b74eb3739681f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"6b6f2566603dae877cb14108e2f285eac227a746","url":"https://github.com/nreed97/EzFD/commit/6b6f2566603dae877cb14108e2f285eac227a746","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"750f7b45c5c5c1d395567e5b4c56bf38fef3d93d","url":"https://github.com/nreed97/EzFD/commit/750f7b45c5c5c1d395567e5b4c56bf38fef3d93d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"60ab7a046d4f76e6b1317fc8d7b1754fe5643670","url":"https://github.com/nreed97/EzFD/commit/60ab7a046d4f76e6b1317fc8d7b1754fe5643670","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"1656ee38b6a03663632b85d1bc40789976511a1f","url":"https://github.com/nreed97/EzFD/commit/1656ee38b6a03663632b85d1bc40789976511a1f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"0f683f26eca6a2986ca5a42e391a1f5ee3685509","url":"https://github.com/nreed97/EzFD/commit/0f683f26eca6a2986ca5a42e391a1f5ee3685509","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"5b1c8bd2aad369f0c48f99b2813eddc95e6608e0","url":"https://github.com/nreed97/EzFD/commit/5b1c8bd2aad369f0c48f99b2813eddc95e6608e0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"b8329fd0166b4aca4514eabc47f9d9e4bda0d615","url":"https://github.com/nreed97/EzFD/commit/b8329fd0166b4aca4514eabc47f9d9e4bda0d615","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"47a6011c8346ba599f6cc67d03d5968d9de0c2c8","url":"https://github.com/nreed97/EzFD/commit/47a6011c8346ba599f6cc67d03d5968d9de0c2c8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"22b66ff967796b3f83ee85145cba6ed7480fb1d1","url":"https://github.com/nreed97/EzFD/commit/22b66ff967796b3f83ee85145cba6ed7480fb1d1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"3ab6d17fa88d6b16f46397afbd696171e29b1cac","url":"https://github.com/nreed97/EzFD/commit/3ab6d17fa88d6b16f46397afbd696171e29b1cac","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"1745f87451b7b13de8e7cab3a075e1b7b2e62915","url":"https://github.com/nreed97/EzFD/commit/1745f87451b7b13de8e7cab3a075e1b7b2e62915","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"21b61972b9bc03a4a0e34879bc8908d5b973642e","url":"https://github.com/nreed97/EzFD/commit/21b61972b9bc03a4a0e34879bc8908d5b973642e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"2110c1a4592185835f25aafa3595ef556416f154","url":"https://github.com/nreed97/EzFD/commit/2110c1a4592185835f25aafa3595ef556416f154","weight":0.9}],"data":{"attributed_loc_by_commit":{"91126dab31696d32e768a19139c758b1c1a01f0b":1713,"32629966043624f5a0faf1dbe56d100958720e27":389,"5f61e468b7106909abe01cde9651cdc56c0dd07d":330,"3a27bdbab220f504f5773cba1ba3979a2b0f8b63":422,"af7805469b487e4dd334b56bf3c25e41bb44eb94":386,"2c80e8962136907431c5cf2e30c4be4589ba9777":13,"727cbafd1d46c8e82923a16c8772c0ae46cc6533":3,"63420b378610addf962d1aa44174a690e286be58":48,"6a08c01aea28d111f432d2e574fe6276073b6516":4,"dcbb87e4d988b0c408488d749446e6a7ed269060":13,"464e3a608f56487bffc8051fda3237002d1c71ed":48,"839c1f96b01ff89b7d7234f9abf0bbaabc77c5b7":16,"02f01fb8b25ae3a275128ace2220442fccd819e8":1,"214d988a5136e39085b20c78ab83f6d8e145d388":100,"feab7227f897984698fdd754589260510c5a9494":38,"bd002c4d4b611c9c29141cf1f9fc22014844cb6b":34,"247987c37610eafe9049ead8586c4c0ec83d5396":75,"59417c03ee1b5ee00f8adc57e2ef82a0ea90996b":3,"2227dcfe441dd8b740184d76371463aefa863ee8":336,"253c5bc8ccd13ed143f546a6282eab211b3afb0d":199,"e1837c593d4bcf1d15929e8407e30b6ad8f8ee47":1236,"ea9bc8f80f5c717be5b850bdcfc0471fb327a85b":107,"5104a8ab1c966300b6a6fe3a2518164a2c141263":1,"494f9ebe3ace9591cf1370cf3925396f78b24e57":10,"bdd6d7fec95aa99d6872528625e00350852455eb":219,"d36249015f1a77ab713a07f8bd0dc307da083657":27,"70bbe156f7dcfa5adcce5290734d570cbe5d6833":739,"76187ecdd22b6aa7a2e8eb5bcbe0fbf0b99ce275":1,"7250740871b93e1915f921eb7c28f851d12ab158":40,"95977029d55171d89d675d8086eef0defa55a147":5,"cf7a5ef572f29f7b40bccfbe9b75ad4ee1196659":242,"6d87e794ecb1672f16408679b880ec528ccb348e":40,"f44f8cfa3f3ade8b6c52c17957ad9cb79176bce7":0,"36fb24bb098ea1ec3854fb3c7ef3ef7fee1aabbb":3,"51253191bd3cd1a0fb5588b5361301129890a443":1,"74ed5f1d153aefc24f628abdb47c91d57d6a94e7":25,"a3d267c379328c0b9a253ad2e2a3ba61c6cf2f44":1,"dfbf7b11f0f50c6eb19ab47651cfc07caf37b149":4,"8fcec92f0f5e491d44efcf0fa1009118d7e7f196":1,"fa5dae36dac83d74f5f200548b08229b8df26748":1,"ddba11c387bb28aa6b51bed7a63e338e236378d7":4,"8973c295a1a6882e207705be795ed10e29c44afb":43,"f8ae3e9fe6314a95f35512f3d6158957b3ee6189":8,"94b2ad6f5eb6d61f644d7857ea3ce134f5c13301":100,"65d40d22116feadaf0e0c5c739512a85c3536dda":9,"f60d73af31d34bf1fb3df245b06178016b71c403":30,"2920f1a652e3e7c880b2381e15fc7d35de491d22":25,"c9445e0343aac4d1e345f079f1b061120d5dce9c":0,"c2ecd64681dede151da1068761159e4c4eeae7f4":23,"c369d81bd34e1d4de56f2537b881e75afdff84a9":1,"3156c19fdb435ca2da81e6a4543046636c5ba0ce":13,"ee08e6aafadf8ee5b7168808a637ec0c008470bb":6,"5b42006f40674811a4bae3c009129ca621a92d30":14,"3786ba7ae4b816d100a0f0c0a04741cb28c6cc83":201,"e25c3b6d4db86ea62a20c57ab51d66a4946d6e25":390,"c46653d0000526a0499aa8b0297624feb2fc2b6d":3,"b2c2fca2fc0890f9e22474f432ca6dbaa0945efa":4,"e437517125a367ee4152a2447c0a1e5165da0b9f":1,"1ef69176b881e12d37d529032d0817348984cc49":1,"47da88c8fdb3ec1f89fca7edd1383eb8fbc1c1ea":17,"e3dc5802db0c05c7403ed3d3445f86b04095203f":2,"7526a90d9fdcf906b0b94362fe941924bdcdc33f":8,"d75d876bf907507638c3e1dfcebcca2cdecdd126":79,"2e9554620b399f16152d257cc2751d157ec61e91":0,"5f2066def0f0fe299fe570d817ab995d7e3a7dc8":63,"a5c9f393fe40ca2b5090564d9bc9e36cdb70b5ad":3,"4424ea20adb7311e24ba1ef31f50bc20f86b9ba3":146,"565ca8ca7942c5779d8191ef42fdfa98ce5e3a80":80,"20d0d4409ed2820ddbe576fce3312b5211e251b2":1,"e37df49103b89fc7fdb907eb7a77fd6206dcd467":449,"7574b4dfa0fcf86968576fdc710f2aa5bf864109":8,"a28ea4528b7d00933439c6c47fb7dc21bd89167f":635,"421137d63c14c0b495bb78ff9bc1b783e48f8e37":186,"9914d36e6f45f1798a6f78b3684330618f7489e1":10,"2968012d6319c9137683f075898f2dae3d10377d":176,"834f8a7442e2f73c630ebc9a830e1de4689fc862":12,"15c178d2fe96d7d95c4b4a876c45b779d818481b":2,"0344be0f125a4e9868283866005e609ac39f447d":96,"dd0bdcfb922bd3bf26de6158b14064ec5bc59aac":28,"62e058a3cd8041569d2dc9c99906514f18fd2205":14,"31bfe4001c9d7a931cbfe4b227a17f53444ec7f0":833,"9c6872dca2ffcdbb918415fa3ad6801178bab27e":16,"c26eaadebe7c5ac658425b7320507a7bab1e6068":36,"eb3c38f56ca43980ffa45fdd8424aca289b1267a":86,"e81a8c428eb1319df18a0a90f0fd8147f87ff170":14,"1aa857ae348e37198f9a505070f96a05c8eb8ab7":112,"801430a5aeaef04bdf43f0f6cbd83d90b2b6d562":2,"e9b4c5053420cb1888d7ea4213e99b2ebc038cff":190,"5ed0365f63ccd09138ed65bc233c6d4c0ca5e23c":82,"d2bd072efe912110b78b487961b02fddfbf66e3d":18,"8e58bbeae20b31587c288c65cc332604c58254c1":16,"37e4558a8ca5f87efe6839d0c115ea317f394652":8,"5914a1bfc743c79ee0c9fd016c3ef975b7bba928":59,"bcbaaaeca3dcf0294c8ceddac94206e760588215":6,"e5bdaf693d4d71075f6a7945bbca1569c8ea0b12":0,"db26a44f9e75513d11d69aae3388b804e0780f05":0,"f10a83a8b97cf4ba256ad7ae591f5c0ff5a9af45":0,"ef79c78d109793502d6e9dbd170f2a0d425e5dd9":0,"34eef36628437839bba2617629e144e0ba6c786b":35,"06ee2c272490b36a690e7b4ddaf040abd95945a0":52,"a6cf98a8af80c1a442c5a4d3cbaef4cba617e5fd":22,"ccf5272f13871bd6130046a21af8d8a5e896a233":55,"4240ac0271e5c0f54ec19fb2c925e218ead76b42":161,"6bdba599a5da40d3021d52149f5aa47379203e30":14,"d195a73ddac0ec52ce283f360c0f9149634183fd":67,"f654f229c277985cf3ecdb9316705122abe557ec":384,"8fc9fc2958bcaed69a87ba5fd773c7e50eb8c24d":2,"717e64e78d4d1bebdecaec4900d8b61338643308":59,"222d9129c06d713e16443b2d3468a74aec73e656":198,"eea685c560414c07047b1ffeca006962fc909b84":1975,"ca72a2da4822c21ca0dcf93d647b0ce1ae29fc61":728,"a057a838731fd1f251051053dee1978220f96dd0":534,"b862ad0fe7e78b971cd4eb64d39f39e7af709580":57,"d7a610c941179cab9e0d7ab1a2cf5c839095baff":0,"f1a667c96cb6d859c8ff6c50f29c5249f093c150":135,"4775092cdd6f3f7e400b45c83a82afe3eac6ec3d":0,"ba44cca5f6ff22d8584aaebce9b2742fc56cd3ff":0,"d21a6c4047c6dcef709676fd8525f97fe2a1d37d":944,"d2f4a766e8214a4499991484886c5d0e038e6802":49,"0fc02838c5d44b74582c0b4c35c06ad96b6ebc7b":416,"0fb97ba4ee650310181d2aa5817dfaa81921ccdb":45,"31dd483a4c81f1bacd50f55dded2598c34d5ac44":0,"47e9501eaaa89f1ace5c2efd5602cccc03d8eb44":141,"c6acf5883237ad476c531f65b50a3bada8ed0c97":364,"74be75d150c2c30adbb51e992c848f04e846399a":237,"dc556e6c9c22458abf623f619f43a67bf11ca843":242,"b2ecffcda99975eecce1a890f5924269c3c5f03d":306,"fea605e788eefdbf944563f524d955ac7f7534f4":221,"a03e0f5ff6ff3f7d604a681a2cffc04526549fe8":0,"3469996ea501f0e9167f2f2b0c3a4e5c3eab1832":400,"2f575cf4e3fb1a1ceff927bdc9bdec62da14a79b":463,"f021d1c7213bc5e922ff4c36ba1c7ad98134d00f":17,"6a0a249587856ea2594351b3edabf38eb77c6c58":358,"910073714dd6ead54d5b578b0feb9cd72f1a1c4b":227,"23e87ea85ab215d432debebe8de8bb4462c6c0bf":68,"1921eadced043f8508b12177e05c57c3c861f343":357,"bb921a6f970ce9aef326f0764a51ae4bebcd6414":155,"97676ab956e22163f471302bb774884c1273ff5f":204,"fe315277291e71a3fe70fd614ad66b92cb7a4c20":354,"e686df50bd772905969194055f647cd02424d7d2":5,"360d76cdd65b0948ba38f7c711124dd3e7335d57":22,"3a7911f5de6cdf3be0e3efd585303632709b5352":11,"3806bf2b63b57abd30a9dd70bb0cc195394918ef":0,"c54c3e9500fd3a632d016966f2a2deb2f72ea053":434,"21f4f901d96d541cb344698e3ba6e7586ee3157b":12,"ee3c06fa3a73e8bc0abadb82b0701ba22c4d80c8":319,"e2bb6ba59911093bd2bc48fc8a4a357a560e726d":0,"62b94396638f1375fcdbf36c6efd57a6a32b5d94":62,"bdac4b6d8d00d258fcede5f089f75dce0a216deb":340,"74b7986e0d50a77b903ba3a6748f0be21fdbbc53":0,"cc124c6458d6ec28865371beb67a02ab72da4262":8,"eaaaca888740586b5782ca8ade3d2bee0de34dd9":0,"8ec913f8b5d6655d3a694f1444e323c98dcef5a4":910,"a86bde402cc89ee5fdfdb71c1aaeebdaea6b1b36":0,"099d17753b72a1643ac2068cfa06a7d472c6b6a9":0,"b5e391d14cfae467726fe90f325be5e3cc6d0fc1":0,"8c7bc76bb03a4cae8153f10a94496bef1b0e7f32":0,"dc6e9da97e234350c69b201a91d6bfd3ebfa09f7":6,"2f11d60baa0a0d30e7c34b4a2157c288c79b5c4e":643,"bd0257777245fa591468a744dba98be54aca6b8d":32,"2208c421e8d8e0cd76014fd655ea23e20b9efb85":38,"502d542fb236928ba7427b818db2ee108628f7ad":359,"9b18aed3dbcb4c72ed9c885fc3e8d03ad7688fa7":50,"70855039159771198601e63c109ef9bcb0d9a0e7":10,"b1a7ea34f613a32dee2a76f438055b1ce622be19":127,"85117b063ebc0ea068c23b8698f26839aed10f4e":343,"50c6161ccdca668cb02e71297ab6c58e8f17048d":0,"6344c8a5be1288dc69800b2d3cf056ad9c01c1c4":690,"0b5460309e8fdc3f4ff45a926518e5df1290844c":402,"b4cc0ea91d1572468a5f94401df79bbe597bf809":689,"1a90881d31444393d4a5b20e2c43c8f8047c26eb":1189,"39845530c33aca20fb0102d4c17baf61e911e26f":840,"4365202c358f1fefd4d93aad99447a337808e877":0,"5eeaffb0efa83da7dc3a6e9d252767c269e45be5":363,"d0dbeda00920a30bf594924c2270427aae94489a":183,"ceec3d89a6b0efbbfb51b2956c99e255f97b5ecb":69,"8f0d2d18a648382706c027cac499d50705815c30":276,"de8f57e21cd0023c857ddcad616acba68a7771d7":965,"414937596d11c5a8704f4afb9c0abb6268a7fb46":66,"0edc5afe39a1e1619cd1f012dc6ac62a17ad9657":298,"3e252a12b3409b15d0741639261f7745c22d2448":233,"5cb340e5d66f96ded16567f30086b85273160e7b":8,"d943580d40f93f6327abe5480595cc21ca93e8ee":387,"6dbadd3e70ee1b8cf061507b53c78fd7170e505b":330,"1fe14abbea3d0e654c2b9b7ad190a68c1e8e6f70":0,"c4169edf88776620d43468b97ac1969861bc6591":0,"f0e26519b0860d374d108e449f5c4778551aabd7":251,"fd8f8dd6d26e37910e1ef8d65a04f47b8e413d53":934,"acfaac1b6b257aa3f591d6f26d2e0fe424e53028":2,"456cc9fc7009f3ca9b8700b52ca854501294240a":77,"fbe75d6473cde9f197d362433129c6a1e98d91b3":118,"77f1276aafd1672877ac72c8ae828bb49a9429fd":326,"4c674cc1c809cae0a485f904159d7d6ac642a8e5":109,"38e35084bde866ae1dfbff25eecb722314c72c17":333,"6c48035d052cb252126179319cbd47a52115eab9":62,"2110c1a4592185835f25aafa3595ef556416f154":766,"21b61972b9bc03a4a0e34879bc8908d5b973642e":43,"1745f87451b7b13de8e7cab3a075e1b7b2e62915":6,"3ab6d17fa88d6b16f46397afbd696171e29b1cac":0,"22b66ff967796b3f83ee85145cba6ed7480fb1d1":0,"47a6011c8346ba599f6cc67d03d5968d9de0c2c8":30,"b8329fd0166b4aca4514eabc47f9d9e4bda0d615":0,"5b1c8bd2aad369f0c48f99b2813eddc95e6608e0":301,"0f683f26eca6a2986ca5a42e391a1f5ee3685509":0,"1656ee38b6a03663632b85d1bc40789976511a1f":21,"60ab7a046d4f76e6b1317fc8d7b1754fe5643670":11,"750f7b45c5c5c1d395567e5b4c56bf38fef3d93d":0,"6b6f2566603dae877cb14108e2f285eac227a746":27,"36b2225d2a8d878fa09f8e567a9b74eb3739681f":0,"dd52704ab6e9f200bcd58bc51f5f3168bc5c9cf4":71,"9fb502dcf1a9aba3d69d5c440149eab0aa1610c0":148,"955d4191df4cc38ba3d43dbb55e4dfec15e664fb":80,"17a11902cdaa45c16623d4c00e448cb2488a391c":0,"076dd86586e522ef7ebc729e8e1a1acd6634c172":0,"c854e2d213c6a1df4324889149179f51cc74c53e":117,"f0be4418a9dcc73e2820d563a496ee0470dff8c4":1359,"5f2bbf3fe342829efbb3b2831effb8497b8a6e89":0,"ac59fe84d747f8dd3c2ee449a5f1fa3df4a92704":676,"41d51dfc989a228b93d676273f9ee99dffb28b6f":0,"01f4d87678626b89a929adf1a896ea944bddb1ef":2},"tools":{"claude-code":{"name":"Claude Code","commits":220,"loc":37878,"first_seen":1782610966,"last_seen":1794543136}},"monthly":{"2026-06":{"loc":8278,"attributed_loc":8148},"2026-07":{"loc":3946,"attributed_loc":3946},"2026-08":{"loc":13616,"attributed_loc":13616},"2026-09":{"loc":9355,"attributed_loc":9355},"2026-10":{"loc":2811,"attributed_loc":2811},"2026-11":{"loc":2,"attributed_loc":2}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1782610515.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1782610515},{"tool":"generic-agent","path":"AGENTS.md","added_at":1782610515}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":53.0,"flagged_units":5.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":38008.0,"flagged_loc":12596.0,"flagged_loc_share":0.3314039149652705,"max_loc_per_hour":790.8081791626096,"median_loc_per_hour":191.5,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,128 lines of first-party code in ~1.4h (791 lines/hour, 3 commit session)","ref":"d2f4a766e8214a4499991484886c5d0e038e6802","url":"https://github.com/nreed97/EzFD/commit/d2f4a766e8214a4499991484886c5d0e038e6802","weight":0.23724245374878286},{"kind":"velocity-burst","description":"3,370 lines of first-party code in ~4.5h (742 lines/hour, 6 commit session)","ref":"af7805469b487e4dd334b56bf3c25e41bb44eb94","url":"https://github.com/nreed97/EzFD/commit/af7805469b487e4dd334b56bf3c25e41bb44eb94","weight":0.2226191204355006},{"kind":"velocity-burst","description":"1,731 lines of first-party code in ~2.6h (672 lines/hour, 5 commit session)","ref":"8f0d2d18a648382706c027cac499d50705815c30","url":"https://github.com/nreed97/EzFD/commit/8f0d2d18a648382706c027cac499d50705815c30","weight":0.20158291999137373},{"kind":"velocity-burst","description":"3,492 lines of first-party code in ~5.3h (662 lines/hour, 5 commit session)","ref":"b862ad0fe7e78b971cd4eb64d39f39e7af709580","url":"https://github.com/nreed97/EzFD/commit/b862ad0fe7e78b971cd4eb64d39f39e7af709580","weight":0.1987332033514254},{"kind":"velocity-burst","description":"2,875 lines of first-party code in ~5.1h (569 lines/hour, 10 commit session)","ref":"76187ecdd22b6aa7a2e8eb5bcbe0fbf0b99ce275","url":"https://github.com/nreed97/EzFD/commit/76187ecdd22b6aa7a2e8eb5bcbe0fbf0b99ce275","weight":0.17057627863538977}],"data":{"flagged_loc_by_commit":{"7b4a61204d3935a173d9f15dc86154f5e1725578":130,"91126dab31696d32e768a19139c758b1c1a01f0b":1713,"32629966043624f5a0faf1dbe56d100958720e27":389,"5f61e468b7106909abe01cde9651cdc56c0dd07d":330,"3a27bdbab220f504f5773cba1ba3979a2b0f8b63":422,"af7805469b487e4dd334b56bf3c25e41bb44eb94":386,"2227dcfe441dd8b740184d76371463aefa863ee8":336,"253c5bc8ccd13ed143f546a6282eab211b3afb0d":199,"e1837c593d4bcf1d15929e8407e30b6ad8f8ee47":1236,"ea9bc8f80f5c717be5b850bdcfc0471fb327a85b":107,"5104a8ab1c966300b6a6fe3a2518164a2c141263":1,"494f9ebe3ace9591cf1370cf3925396f78b24e57":10,"bdd6d7fec95aa99d6872528625e00350852455eb":219,"d36249015f1a77ab713a07f8bd0dc307da083657":27,"70bbe156f7dcfa5adcce5290734d570cbe5d6833":739,"76187ecdd22b6aa7a2e8eb5bcbe0fbf0b99ce275":1,"222d9129c06d713e16443b2d3468a74aec73e656":198,"eea685c560414c07047b1ffeca006962fc909b84":1975,"ca72a2da4822c21ca0dcf93d647b0ce1ae29fc61":728,"a057a838731fd1f251051053dee1978220f96dd0":534,"b862ad0fe7e78b971cd4eb64d39f39e7af709580":57,"f1a667c96cb6d859c8ff6c50f29c5249f093c150":135,"d21a6c4047c6dcef709676fd8525f97fe2a1d37d":944,"d2f4a766e8214a4499991484886c5d0e038e6802":49,"39845530c33aca20fb0102d4c17baf61e911e26f":840,"5eeaffb0efa83da7dc3a6e9d252767c269e45be5":363,"d0dbeda00920a30bf594924c2270427aae94489a":183,"ceec3d89a6b0efbbfb51b2956c99e255f97b5ecb":69,"8f0d2d18a648382706c027cac499d50705815c30":276},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":31764.0,"index":0.11,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.031,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":5.0,"per_kloc:emoji_in_code":0.157,"files:emoji_in_code":4.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // then, after that was fixed, as an Afro-Eurasia written one world-width to","ref":"scripts/test-sections.cjs:273","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/scripts/test-sections.cjs#L273","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":73.0,"findings_high":12.0,"findings_medium":61.0,"findings_low":0.0,"weighted_findings":26.7,"scanned_lines":30585.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":30,"fingerprint":"dockerfile.security.missing-user-entrypoint:Dockerfile:30"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"ezfd-rig-bridge.py","line":66,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:ezfd-rig-bridge.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"ezfd-rig-bridge.py","line":69,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:ezfd-rig-bridge.py:69"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"ezfd-rig-bridge.py","line":73,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:ezfd-rig-bridge.py:73"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"ezfd-rig-bridge.py","line":310,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:ezfd-rig-bridge.py:310"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"ezfd-rig-bridge.py","line":486,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:ezfd-rig-bridge.py:486"},{"rule_id":"opengrep/javascript.node-crypto.security.gcm-no-tag-length","severity":"high","message":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authenticatio [confidence medium]","path":"lib/crypto.ts","line":30,"fingerprint":"javascript.node-crypto.security.gcm-no-tag-length:lib/crypto.ts:30"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"public/ezfd-rig-bridge.py","line":66,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:public/ezfd-rig-bridge.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"public/ezfd-rig-bridge.py","line":69,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:public/ezfd-rig-bridge.py:69"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"public/ezfd-rig-bridge.py","line":73,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:public/ezfd-rig-bridge.py:73"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"public/ezfd-rig-bridge.py","line":310,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:public/ezfd-rig-bridge.py:310"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"public/ezfd-rig-bridge.py","line":486,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:public/ezfd-rig-bridge.py:486"},{"rule_id":"opengrep/typescript.react.security.audit.react-dangerouslysetinnerhtml","severity":"medium","message":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT [confidence medium]","path":"components/DocBody.tsx","line":12,"fingerprint":"typescript.react.security.audit.react-dangerouslysetinnerhtml:components/DocBody.tsx:12"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"components/MapView.tsx","line":167,"fingerprint":"javascript.lang.security.html-in-template-string:components/MapView.tsx:167"},{"rule_id":"opengrep/bash.lang.security.ifs-tampering","severity":"medium","message":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'. [confidence low]","path":"deploy.sh","line":21,"fingerprint":"bash.lang.security.ifs-tampering:deploy.sh:21"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"deploy.sh","line":289,"fingerprint":"bash.curl.security.curl-pipe-bash:deploy.sh:289"},{"rule_id":"opengrep/bash.lang.security.ifs-tampering","severity":"medium","message":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'. [confidence low]","path":"ezfd-admin.sh","line":15,"fingerprint":"bash.lang.security.ifs-tampering:ezfd-admin.sh:15"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"ezfd-rig-bridge.py","line":201,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:ezfd-rig-bridge.py:201"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"ezfd-rig-bridge.py","line":231,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:ezfd-rig-bridge.py:231"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `k` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"lib/clockSource.ts","line":75,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:lib/clockSource.ts:75"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `slug` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/docs.ts","line":52,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/docs.ts:52"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/docs.ts","line":52,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/docs.ts:52"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"lib/docs.ts","line":204,"fingerprint":"javascript.lang.security.html-in-template-string:lib/docs.ts:204"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"lib/docs.ts","line":209,"fingerprint":"javascript.lang.security.html-in-template-string:lib/docs.ts:209"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"lib/docs.ts","line":238,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:lib/docs.ts:238"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"lib/docs.ts","line":238,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:lib/docs.ts:238"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"public/ezfd-rig-bridge.py","line":201,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:public/ezfd-rig-bridge.py:201"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"public/ezfd-rig-bridge.py","line":231,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:public/ezfd-rig-bridge.py:231"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"scripts/_compile-ts.cjs","line":59,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:scripts/_compile-ts.cjs:59"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/_compile-ts.cjs","line":59,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/_compile-ts.cjs:59"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":120,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:120"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":122,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:122"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":187,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:187"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":200,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:200"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":367,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:367"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":368,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:368"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":370,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:370"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/build-site.cjs","line":370,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/build-site.cjs:370"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/build-site.cjs","line":370,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/build-site.cjs:370"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":372,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:372"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":377,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:377"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":392,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:392"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/build-site.cjs","line":393,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/build-site.cjs:393"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `rel` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/build-site.cjs","line":422,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/build-site.cjs:422"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/build-site.cjs","line":422,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/build-site.cjs:422"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/build-site.cjs","line":445,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/build-site.cjs:445"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/build-site.cjs","line":446,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/build-site.cjs:446"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/build-site.cjs","line":446,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/build-site.cjs:446"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/build-site.cjs","line":455,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/build-site.cjs:455"},{"rule_id":"opengrep/javascript.playwright.security.audit.playwright-goto-injection","severity":"medium","message":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities [confidence low]","path":"scripts/record-gifs.cjs","line":57,"fingerprint":"javascript.playwright.security.audit.playwright-goto-injection:scripts/record-gifs.cjs:57"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/record-gifs.cjs","line":97,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/record-gifs.cjs:97"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `out` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/record-gifs.cjs","line":99,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/record-gifs.cjs:99"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/record-gifs.cjs","line":99,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/record-gifs.cjs:99"},{"rule_id":"opengrep/javascript.playwright.security.audit.playwright-goto-injection","severity":"medium","message":"If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities [confidence low]","path":"scripts/record-gifs.cjs","line":139,"fingerprint":"javascript.playwright.security.audit.playwright-goto-injection:scripts/record-gifs.cjs:139"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-changelog-links.cjs","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-changelog-links.cjs:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-nav.cjs","line":39,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-nav.cjs:39"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-nav.cjs","line":39,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-nav.cjs:39"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-nav.cjs","line":43,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-nav.cjs:43"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"scripts/test-nav.cjs","line":209,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/test-nav.cjs:209"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `l` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"scripts/test-nav.cjs","line":244,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/test-nav.cjs:244"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/test-nav.cjs","line":383,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/test-nav.cjs:383"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-nav.cjs","line":402,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-nav.cjs:402"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-nav.cjs","line":402,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-nav.cjs:402"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-nav.cjs","line":406,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-nav.cjs:406"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-nav.cjs","line":406,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-nav.cjs:406"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-nav.cjs","line":460,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-nav.cjs:460"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-nav.cjs","line":460,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-nav.cjs:460"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-nav.cjs","line":464,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-nav.cjs:464"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-nav.cjs","line":464,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-nav.cjs:464"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-sections.cjs","line":26,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-sections.cjs:26"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-sections.cjs","line":26,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-sections.cjs:26"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-sections.cjs","line":137,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-sections.cjs:137"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-sections.cjs","line":137,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-sections.cjs:137"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash","python","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":2.0,"vulnerabilities":2.0,"vulns_critical":0.0,"vulns_high":1.0,"vulns_medium":1.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":11.0},"findings":[{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.4.3 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.4.3 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.5 (npm):GHSA-g3hv-75wg-m249"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":24.0,"findings_high":12.0,"findings_medium":7.0,"findings_low":5.0,"penalty":165.5},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":41,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:41"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":228,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:228"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":230,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:230"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":269,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:269"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":332,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:332"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/pages.yml","line":19,"fingerprint":"excessive-permissions:.github/workflows/pages.yml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/pages.yml","line":20,"fingerprint":"excessive-permissions:.github/workflows/pages.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":34,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:34"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":44,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":56,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:56"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":8,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:8"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":26,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:26"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":15,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:15"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":26,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:26"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":213,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:213"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":266,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:266"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":329,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:329"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":41,"fingerprint":"artipacked:.github/workflows/ci.yml:41"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":228,"fingerprint":"artipacked:.github/workflows/ci.yml:228"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":269,"fingerprint":"artipacked:.github/workflows/ci.yml:269"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":332,"fingerprint":"artipacked:.github/workflows/ci.yml:332"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/pages.yml","line":32,"fingerprint":"artipacked:.github/workflows/pages.yml:32"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":1.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.605,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1541.0,"function_nloc":14134.0,"mean_ccn":2.84,"p90_ccn":6.0,"complex_functions":37.0,"long_functions":19.0,"many_param_functions":0.0,"risky_nloc_share":0.3436},"findings":[],"evidence":[{"kind":"complex-function","description":"QSOForm in components/QSOForm.tsx: complexity 59, 277 lines","ref":"components/QSOForm.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/components/QSOForm.tsx#L92","weight":0.9833333333333333},{"kind":"complex-function","description":"LoggingClient in components/LoggingClient.tsx: complexity 46, 297 lines","ref":"components/LoggingClient.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/components/LoggingClient.tsx#L50","weight":0.7666666666666667},{"kind":"complex-function","description":"POST in app/api/qso/route.ts: complexity 45, 116 lines","ref":"app/api/qso/route.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/api/qso/route.ts#L11","weight":0.75},{"kind":"complex-function","description":"preflight in lib/preflight.ts: complexity 44, 197 lines","ref":"lib/preflight.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/lib/preflight.ts#L72","weight":0.7333333333333333},{"kind":"complex-function","description":"POST in app/api/events/route.ts: complexity 38, 99 lines","ref":"app/api/events/route.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/api/events/route.ts#L10","weight":0.6333333333333333},{"kind":"complex-function","description":"DashboardClient in components/DashboardClient.tsx: complexity 36, 234 lines","ref":"components/DashboardClient.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/components/DashboardClient.tsx#L62","weight":0.6},{"kind":"complex-function","description":"parseAdif in lib/adif.ts: complexity 33, 55 lines","ref":"lib/adif.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/lib/adif.ts#L55","weight":0.55},{"kind":"complex-function","description":"mhzToBand in lib/adif.ts: complexity 29, 18 lines","ref":"lib/adif.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/lib/adif.ts#L23","weight":0.48333333333333334},{"kind":"complex-function","description":"SlotCoordination in components/SlotCoordination.tsx: complexity 27, 168 lines","ref":"components/SlotCoordination.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/components/SlotCoordination.tsx#L103","weight":0.45},{"kind":"complex-function","description":"(anonymous) in scripts/test-queries.cjs: complexity 26, 241 lines","ref":"scripts/test-queries.cjs","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/scripts/test-queries.cjs#L33","weight":0.43333333333333335}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":25002.0,"duplicated_lines":2030.0,"duplicated_share":0.0812,"files":148.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/callhistory/route.ts:7 and app/api/qrz/route.ts:5","ref":"app/api/callhistory/route.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/api/callhistory/route.ts#L7","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/download/relay/route.ts:152 and app/api/download/relay/route.ts:196","ref":"app/api/download/relay/route.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/api/download/relay/route.ts#L152","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/import/adif/route.ts:73 and scripts/test-queries.cjs:225","ref":"app/api/import/adif/route.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/api/import/adif/route.ts#L73","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/presence/route.ts:56 and app/api/ses/operators/route.ts:14","ref":"app/api/presence/route.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/api/presence/route.ts#L56","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/qso/route.ts:165 and lib/callHistory.ts:124","ref":"app/api/qso/route.ts","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/api/qso/route.ts#L165","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/event/[code]/cw/page.tsx:15 and app/event/[code]/log/page.tsx:15","ref":"app/event/[code]/cw/page.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/event/[code]/cw/page.tsx#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/event/new/page.tsx:211 and app/event/new/page.tsx:526","ref":"app/event/new/page.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/app/event/new/page.tsx#L211","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: components/BandActivity.tsx:93 and components/DashboardClient.tsx:135","ref":"components/BandActivity.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/components/BandActivity.tsx#L93","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: components/CheckoutBoard.tsx:48 and components/SlotCoordination.tsx:87","ref":"components/CheckoutBoard.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/components/CheckoutBoard.tsx#L48","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: components/CheckoutBoard.tsx:99 and components/CheckoutBoard.tsx:148","ref":"components/CheckoutBoard.tsx","url":"https://github.com/nreed97/EzFD/blob/72083165c9b33312033df3af08970cdafbf00a4d/components/CheckoutBoard.tsx#L99","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":48.0,"weighted_findings":35.0,"scanned_lines":30585.0,"category:best-practice":5.0,"category:correctness":41.0,"category:maintainability":2.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"ezfd-rig-bridge.py","line":487,"fingerprint":"python.lang.best-practice.arbitrary-sleep:ezfd-rig-bridge.py:487"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `handler` is defined inside a function but never used","path":"ezfd-rig-bridge.py","line":795,"fingerprint":"python.lang.maintainability.useless-inner-function:ezfd-rig-bridge.py:795"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"public/ezfd-rig-bridge.py","line":487,"fingerprint":"python.lang.best-practice.arbitrary-sleep:public/ezfd-rig-bridge.py:487"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `handler` is defined inside a function but never used","path":"public/ezfd-rig-bridge.py","line":795,"fingerprint":"python.lang.maintainability.useless-inner-function:public/ezfd-rig-bridge.py:795"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"app/api/events/[code]/bonuses/route.ts","line":20,"fingerprint":"javascript.lang.correctness.no-stringify-keys:app/api/events/[code]/bonuses/route.ts:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"app/api/events/[code]/bonuses/route.ts","line":21,"fingerprint":"javascript.lang.correctness.no-stringify-keys:app/api/events/[code]/bonuses/route.ts:21"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"app/api/export/[code]/route.ts","line":71,"fingerprint":"javascript.lang.correctness.no-stringify-keys:app/api/export/[code]/route.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"app/api/import/event/route.ts","line":77,"fingerprint":"javascript.lang.correctness.no-stringify-keys:app/api/import/event/route.ts:77"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"app/page.tsx","line":41,"fingerprint":"javascript.lang.correctness.no-stringify-keys:app/page.tsx:41"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/NavDrawer.tsx","line":175,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/NavDrawer.tsx:175"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"components/QSOTable.tsx","line":321,"fingerprint":"javascript.lang.best-practice.javascript-confirm:components/QSOTable.tsx:321"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"ezfd-rig-bridge.py","line":66,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:ezfd-rig-bridge.py:66"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"ezfd-rig-bridge.py","line":271,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:ezfd-rig-bridge.py:271"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"lib/realtime.ts","line":115,"fingerprint":"javascript.lang.correctness.no-stringify-keys:lib/realtime.ts:115"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"public/ezfd-rig-bridge.py","line":66,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:public/ezfd-rig-bridge.py:66"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"public/ezfd-rig-bridge.py","line":271,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:public/ezfd-rig-bridge.py:271"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/_compile-ts.cjs","line":59,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/_compile-ts.cjs:59"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/test-merge.cjs","line":135,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/test-merge.cjs:135"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/test-merge.cjs","line":136,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/test-merge.cjs:136"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/test-merge.cjs","line":137,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/test-merge.cjs:137"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"app/layout.tsx","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:app/layout.tsx:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"app/layout.tsx","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:app/layout.tsx:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"components/CheckoutBoard.tsx","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:components/CheckoutBoard.tsx:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"components/CheckoutBoard.tsx","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:components/CheckoutBoard.tsx:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"components/SlotCoordination.tsx","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:components/SlotCoordination.tsx:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"components/SlotCoordination.tsx","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:components/SlotCoordination.tsx:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"components/SummarySheet.tsx","line":59,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:components/SummarySheet.tsx:59"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"components/SummarySheet.tsx","line":59,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:components/SummarySheet.tsx:59"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ezfd-admin.sh","line":1128,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ezfd-admin.sh:1128"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ezfd-admin.sh","line":1131,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ezfd-admin.sh:1131"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1138,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1138"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1168,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1168"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1180,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1180"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1190,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1190"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1204,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1204"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1205,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1205"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ezfd-admin.sh","line":1207,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ezfd-admin.sh:1207"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1231,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1231"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1299,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1299"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"ezfd-admin.sh","line":1301,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:ezfd-admin.sh:1301"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ezfd-admin.sh","line":1324,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ezfd-admin.sh:1324"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"scripts/record-gifs.cjs","line":18,"fingerprint":"javascript.lang.correctness.useless-assignment:scripts/record-gifs.cjs:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test-docker.sh","line":149,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test-docker.sh:149"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"scripts/test-docker.sh","line":167,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:scripts/test-docker.sh:167"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"scripts/test-e2e.sh","line":349,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:scripts/test-e2e.sh:349"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test-restore.sh","line":26,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test-restore.sh:26"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test-restore.sh","line":43,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test-restore.sh:43"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test-restore.sh","line":53,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test-restore.sh:53"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":1.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":31764.0,"test_ratio":0.0,"ci_files":2.0,"cochange_share":0.0,"cochange_commits":189.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/pages.yml","ref":".github/workflows/pages.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (tsc --noEmit, shellcheck)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":["tsc --noEmit","shellcheck"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":195.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"docs/changelog.md","ref":"docs/changelog.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.9132,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":31713.0,"other_lines":51.0,"files_blamed":148.0,"blame_failures":0.0,"quality:ai_findings":48.0,"quality:ai_per_kloc":1.514,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":72.0,"security:ai_per_kloc":2.27,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}