{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:06.997923Z","repo":{"ref":{"host":"github.com","owner":"qax-os","name":"goreporter"},"default_branch":"master","clone_url":"https://github.com/qax-os/goreporter.git","html_url":"https://github.com/qax-os/goreporter","description":"A Golang tool that does static analysis, unit testing, code review and generate code quality report.","stars":3124,"forks":259,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":30319,"primary_language":"Go","license_spdx":"Apache-2.0","created_at":"2017-03-27T08:46:38Z","pushed_at":"2018-10-27T22:30:57Z","security_policy_url":null,"distribution":{"owner_created_at":"2017-06-27T13:59:18Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5","profile":{"lines_by_language":{"Go":48290,"Shell":14},"files_by_category":{"vendored":428,"source":349,"test":61,"docs":22,"binary":10,"other":10,"config":4,"oversized":1},"source_lines":43363,"test_lines":4941},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.122},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":53.8,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":52.2,"duplication":34.9,"lint":94.9,"testing":50.7,"docs":80.0,"type_safety":null,"process":5.0},"summary":"Code quality is weak: test-to-source ratio 0.11, no CI test run detected; 22% of function code in complex or long functions; 18% duplicated lines. Weakest area: process."},"security":{"score":71.7,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":97.9,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":20.0},"summary":"Security posture is adequate: 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.0,"check:Code-Review":1.0,"check:Maintained":0.0,"check:Binary-Artifacts":10.0,"check:CII-Best-Practices":0.0,"check:Pinned-Dependencies":0.0,"check:Security-Policy":0.0,"check:License":10.0,"check:Fuzzing":0.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 1/10 (Found 4/21 approved changesets -- score normalized to 1)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":0.9},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/qax-os/goreporter","weight":1.0}],"data":{"date":"2026-10-19","commit":"df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":209.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":193759.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2017-03":{"loc":70964,"attributed_loc":0},"2017-04":{"loc":97943,"attributed_loc":0},"2017-05":{"loc":6615,"attributed_loc":0},"2017-06":{"loc":564,"attributed_loc":0},"2017-07":{"loc":13093,"attributed_loc":0},"2017-08":{"loc":211,"attributed_loc":0},"2017-09":{"loc":1255,"attributed_loc":0},"2017-10":{"loc":3037,"attributed_loc":0},"2017-11":{"loc":5,"attributed_loc":0},"2017-12":{"loc":3,"attributed_loc":0},"2018-04":{"loc":16,"attributed_loc":0},"2018-05":{"loc":48,"attributed_loc":0},"2018-09":{"loc":5,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":94.0,"flagged_units":0.0,"pre_ai_era_bursts":5.0,"pre_ai_era_measured_loc":128837.0,"pre_ai_era_burst_loc":110001.0,"measured_loc":128837.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":18618.34882213097,"median_loc_per_hour":98.34294742256678,"pr_timed_units":2.0,"excluded_import_loc":64922.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["5deab61624b571b077fe0fed6287313dfa04aef4","6a433d396c80e025c38380de9e2a1fe3bb6ccd63"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":17.0,"flagged_releases":0.0,"max_loc_per_day":110001.6},"findings":[],"evidence":[],"data":{"releases":[{"from":"version-1.0.0","to":"version-1.0.1","loc":95709,"days":0.87,"loc_per_day":110001.6,"flagged":false},{"from":"version-1.0.1","to":"version-1.1.0","loc":1836,"days":4.8,"loc_per_day":382.7,"flagged":false},{"from":"version-1.1.0","to":"version-1.1.1","loc":217,"days":1.33,"loc_per_day":163.2,"flagged":false},{"from":"version-1.1.1","to":"version-1.2.0","loc":85,"days":5.97,"loc_per_day":14.2,"flagged":false},{"from":"version-1.2.0","to":"version-1.2.3","loc":96,"days":14.7,"loc_per_day":6.5,"flagged":false},{"from":"version-1.2.3","to":"version-1.5.0","loc":1868,"days":6.3,"loc_per_day":296.3,"flagged":false},{"from":"version-1.5.0","to":"version-1.5.2","loc":21,"days":5.04,"loc_per_day":4.2,"flagged":false},{"from":"version-1.5.2","to":"version2.0.0","loc":4334,"days":7.8,"loc_per_day":555.5,"flagged":false},{"from":"version2.0.0","to":"version2.1.0","loc":57,"days":2.97,"loc_per_day":19.2,"flagged":false},{"from":"version2.1.0","to":"version2.5.0","loc":544,"days":27.1,"loc_per_day":20.1,"flagged":false},{"from":"version2.5.0","to":"pre-3.0","loc":1029,"days":43.83,"loc_per_day":23.5,"flagged":false},{"from":"pre-3.0","to":"version2.6.0","loc":13,"days":17.94,"loc_per_day":0.7,"flagged":false},{"from":"version2.6.0","to":"version3.0.0-beta1","loc":15893,"days":62.15,"loc_per_day":255.7,"flagged":false},{"from":"version3.0.0-beta1","to":"version3.0.0-beta2","loc":109,"days":5.95,"loc_per_day":18.3,"flagged":false},{"from":"version3.0.0-beta2","to":"version3.0.0","loc":905,"days":0.86,"loc_per_day":1055.9,"flagged":false},{"from":"version3.0.0","to":"version3.0.1","loc":2,"days":0.18,"loc_per_day":11.0,"flagged":false},{"from":"version3.0.1","to":"version3.0.2","loc":8,"days":50.2,"loc_per_day":0.2,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":41135.0,"index":0.122,"count:narrated_steps":5.0,"per_kloc:narrated_steps":0.122,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, scan for the last comment that occurs before the \"package\" keyword.","ref":"linters/golint/lint.go:385","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/golint/lint.go#L385","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1.  Number vertices by depth-first preorder.","ref":"linters/simpler/ssa/dom.go:133","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/ssa/dom.go#L133","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3. Implicitly define the immediate dominator of each node.","ref":"linters/simpler/ssa/dom.go:149","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/ssa/dom.go#L149","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2. Compute the semidominators of all nodes.","ref":"linters/simpler/ssa/dom.go:159","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/ssa/dom.go#L159","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 4. Explicitly define the immediate dominator of each","ref":"linters/simpler/ssa/dom.go:183","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/ssa/dom.go#L183","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":7.0,"findings_high":1.0,"findings_medium":6.0,"findings_low":0.0,"weighted_findings":2.6,"scanned_lines":43363.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"engine/report2html.go","line":817,"fingerprint":"go.lang.security.audit.dangerous-exec-command:engine/report2html.go:817"},{"rule_id":"opengrep/go.lang.security.audit.xss.unsafe-template-type","severity":"medium","message":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use  [confidence low]","path":"engine/report2html.go","line":741,"fingerprint":"go.lang.security.audit.xss.unsafe-template-type:engine/report2html.go:741"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"linters/aligncheck/aligncheck.go","line":117,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:linters/aligncheck/aligncheck.go:117"},{"rule_id":"opengrep/go.lang.security.audit.crypto.use-of-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"linters/copycheck/syntax/syntax.go","line":168,"fingerprint":"go.lang.security.audit.crypto.use-of-sha1:linters/copycheck/syntax/syntax.go:168"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"linters/simpler/ssa/testmain.go","line":25,"fingerprint":"go.lang.security.audit.xss.import-text-template:linters/simpler/ssa/testmain.go:25"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"linters/spellcheck/spellcheck.go","line":12,"fingerprint":"go.lang.security.audit.xss.import-text-template:linters/spellcheck/spellcheck.go:12"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"linters/staticcheck/lint.go","line":17,"fingerprint":"go.lang.security.audit.xss.import-text-template:linters/staticcheck/lint.go:17"}],"evidence":[],"data":{"rulesets":["go","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.145,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2294.0,"function_nloc":27137.0,"mean_ccn":3.57,"p90_ccn":8.0,"complex_functions":74.0,"long_functions":13.0,"many_param_functions":0.0,"risky_nloc_share":0.217},"findings":[],"evidence":[{"kind":"complex-function","description":"trans in linters/copycheck/syntax/golang/golang.go: complexity 89, 257 lines","ref":"linters/copycheck/syntax/golang/golang.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/copycheck/syntax/golang/golang.go#L83","weight":1.0},{"kind":"complex-function","description":"BuildGraph in linters/staticcheck/vrp/vrp.go: complexity 68, 214 lines","ref":"linters/staticcheck/vrp/vrp.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/staticcheck/vrp/vrp.go#L241","weight":1.0},{"kind":"complex-function","description":"checkInstr in linters/simpler/ssa/sanity.go: complexity 56, 101 lines","ref":"linters/simpler/ssa/sanity.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/ssa/sanity.go#L92","weight":0.9333333333333333},{"kind":"complex-function","description":"anonymous__27 in linters/simplecode/simple/lint.go: complexity 50, 144 lines","ref":"linters/simplecode/simple/lint.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simplecode/simple/lint.go#L1093","weight":0.8333333333333334},{"kind":"complex-function","description":"anonymous__29 in linters/simpler/lint.go: complexity 50, 144 lines","ref":"linters/simpler/lint.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/lint.go#L1230","weight":0.8333333333333334},{"kind":"complex-function","description":"expr0 in linters/simpler/ssa/builder.go: complexity 48, 204 lines","ref":"linters/simpler/ssa/builder.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/ssa/builder.go#L538","weight":0.8},{"kind":"complex-function","description":"fn in linters/simplecode/testdata/nil-len.go: complexity 47, 56 lines","ref":"linters/simplecode/testdata/nil-len.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simplecode/testdata/nil-len.go#L3","weight":0.7833333333333333},{"kind":"complex-function","description":"stmt in linters/simpler/ssa/builder.go: complexity 47, 147 lines","ref":"linters/simpler/ssa/builder.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/ssa/builder.go#L1956","weight":0.7833333333333333},{"kind":"complex-function","description":"fn in linters/simpler/testdata/nil-len.go: complexity 47, 56 lines","ref":"linters/simpler/testdata/nil-len.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/simpler/testdata/nil-len.go#L3","weight":0.7833333333333333},{"kind":"complex-function","description":"Solve in linters/staticcheck/vrp/vrp.go: complexity 39, 130 lines","ref":"linters/staticcheck/vrp/vrp.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/staticcheck/vrp/vrp.go#L474","weight":0.65}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":29658.0,"duplicated_lines":5209.0,"duplicated_share":0.1756,"files":349.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: engine/config.go:1 and engine/processbar/processbar.go:1","ref":"engine/config.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/config.go#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/config.go:175 and engine/config.go:202","ref":"engine/config.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/config.go#L175","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/report2html.go:8 and linters/gofmt/gofmt.go:8","ref":"engine/report2html.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/report2html.go#L8","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/strategy_deadcode.go:52 and engine/strategy_gofmt.go:51","ref":"engine/strategy_deadcode.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/strategy_deadcode.go#L52","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/strategy_deadcode.go:55 and engine/strategy_interfacer.go:55","ref":"engine/strategy_deadcode.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/strategy_deadcode.go#L55","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/strategy_gofmt.go:44 and engine/strategy_golint.go:45","ref":"engine/strategy_gofmt.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/strategy_gofmt.go#L44","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/strategy_golint.go:34 and engine/strategy_govet.go:38","ref":"engine/strategy_golint.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/strategy_golint.go#L34","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/strategy_simplecode.go:34 and engine/strategy_spellcheck.go:35","ref":"engine/strategy_simplecode.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/strategy_simplecode.go#L34","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: engine/template.html.go:1147 and engine/template.html.go:1261","ref":"engine/template.html.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/engine/template.html.go#L1147","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: linters/aligncheck/aligncheck.go:1 and linters/structcheck/structcheck.go:2","ref":"linters/aligncheck/aligncheck.go","url":"https://github.com/qax-os/goreporter/blob/df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5/linters/aligncheck/aligncheck.go#L1","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"weighted_findings":9.0,"scanned_lines":43363.0,"category:correctness":12.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"engine/report2html.go","line":764,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:engine/report2html.go:764"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"engine/report2html.go","line":779,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:engine/report2html.go:779"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"engine/reporter.go","line":170,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:engine/reporter.go:170"},{"rule_id":"opengrep/go.lang.correctness.use-filepath-join","severity":"medium","message":"`path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators.","path":"linters/countcode/countcode.go","line":186,"fingerprint":"go.lang.correctness.use-filepath-join:linters/countcode/countcode.go:186"},{"rule_id":"opengrep/go.lang.correctness.use-filepath-join","severity":"medium","message":"`path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators.","path":"linters/countcode/countcode.go","line":190,"fingerprint":"go.lang.correctness.use-filepath-join:linters/countcode/countcode.go:190"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"linters/depend/depend.go","line":127,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:linters/depend/depend.go:127"},{"rule_id":"opengrep/go.lang.correctness.use-filepath-join","severity":"medium","message":"`path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators.","path":"linters/simplecode/lint/testutil/util.go","line":50,"fingerprint":"go.lang.correctness.use-filepath-join:linters/simplecode/lint/testutil/util.go:50"},{"rule_id":"opengrep/go.lang.correctness.use-filepath-join","severity":"medium","message":"`path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators.","path":"linters/simpler/lint/testutil/util.go","line":71,"fingerprint":"go.lang.correctness.use-filepath-join:linters/simpler/lint/testutil/util.go:71"},{"rule_id":"opengrep/go.lang.correctness.hardcoded-eq-true-or-false","severity":"low","message":"Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on which expression is in the code.","path":"linters/simpler/ssa/func.go","line":618,"fingerprint":"go.lang.correctness.hardcoded-eq-true-or-false:linters/simpler/ssa/func.go:618"},{"rule_id":"opengrep/go.lang.correctness.hardcoded-eq-true-or-false","severity":"low","message":"Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on which expression is in the code.","path":"linters/simpler/ssa/testmain.go","line":157,"fingerprint":"go.lang.correctness.hardcoded-eq-true-or-false:linters/simpler/ssa/testmain.go:157"},{"rule_id":"opengrep/go.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected useless comparison operation `outFlag == outFlag` or `outFlag != outFlag`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.","path":"linters/spellcheck/spellcheck.go","line":185,"fingerprint":"go.lang.correctness.eqeq-is-bad:linters/spellcheck/spellcheck.go:185"},{"rule_id":"opengrep/go.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected useless comparison operation `workers == workers` or `workers != workers`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.","path":"linters/spellcheck/spellcheck.go","line":204,"fingerprint":"go.lang.correctness.eqeq-is-bad:linters/spellcheck/spellcheck.go:204"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2279,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":4941.0,"source_lines":43363.0,"test_ratio":0.1139,"ci_files":1.0,"cochange_share":0.2619,"cochange_commits":126.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":71.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}