{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.101567Z","repo":{"ref":{"host":"github.com","owner":"rellek550","name":"Pistol-CLI"},"default_branch":"main","clone_url":"https://github.com/rellek550/Pistol-CLI.git","html_url":"https://github.com/rellek550/Pistol-CLI","description":"Windows dev toolkit for project runtimes, diagnostics, ports, code mapping, and repair.","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":401,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-10-01T18:34:48Z","pushed_at":"2026-10-29T17:22:30Z","security_policy_url":null,"distribution":{"owner_created_at":"2025-05-25T16:25:36Z","owner_type":"User","release_assets":[]}},"commit_sha":"961d8b5d588361735a4ce18db29a1af1dbfc5e9a","profile":{"lines_by_language":{"Python":10648,"PowerShell":999,"JavaScript":176},"files_by_category":{"source":51,"test":15,"vendored":6,"docs":3,"config":2,"other":2},"source_lines":9239,"test_lines":2584},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.47,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.6153,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":47.1,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":28.2,"duplication":90.0,"lint":24.8,"testing":44.0,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.28, no CI test run detected; 42% of function code in complex or long functions; 2% duplicated lines. Weakest area: lint."},"security":{"score":59.9,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":93.6,"sast":37.7,"dependencies":null,"ci_actions":null,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 24 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":4.0,"checked":4.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":26.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":12209.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-10":{"loc":12209,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":2.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":8373.0,"flagged_loc":7512.0,"flagged_loc_share":0.8971694733070584,"max_loc_per_hour":1878.0,"median_loc_per_hour":1043.013422818792,"pr_timed_units":0.0,"excluded_import_loc":3836.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"7,512 lines of first-party code in ~4.0h (1,878 lines/hour, 1 commit session)","ref":"58dde428df4d46315cfdc9d7087d67da96ad0f2b","url":"https://github.com/rellek550/Pistol-CLI/commit/58dde428df4d46315cfdc9d7087d67da96ad0f2b","weight":0.5633999999999999}],"data":{"flagged_loc_by_commit":{"58dde428df4d46315cfdc9d7087d67da96ad0f2b":7512},"excluded_import_commits":["4dcbc352ba5cde0615a138d68ec1f767fe317335"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":9239.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":2.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"pistol/lecap.py","line":87,"fingerprint":"pistol/lecap.py:generic-api-key:87"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"pistol/wsl/web/vendor/xterm.js","line":1,"fingerprint":"pistol/wsl/web/vendor/xterm.js:generic-api-key:1"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":34.0,"findings_high":24.0,"findings_medium":10.0,"findings_low":0.0,"weighted_findings":22.95,"scanned_lines":8240.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/doctor.py","line":121,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/doctor.py:121"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/doctor.py","line":136,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/doctor.py:136"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/explorer.py","line":66,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/explorer.py:66"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/fire.py","line":125,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/fire.py:125"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/fire.py","line":178,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/fire.py:178"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/lecap_runtime.py","line":219,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/lecap_runtime.py:219"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/medic.py","line":103,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/medic.py:103"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/pwr.py","line":70,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/pwr.py:70"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/req.py","line":433,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/req.py:433"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/req.py","line":522,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/req.py:522"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/req.py","line":789,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/req.py:789"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'STARTUPINFO' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/windows_explorer.py","line":77,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/windows_explorer.py:77"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/windows_explorer.py","line":80,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/windows_explorer.py:80"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"pistol/windows_explorer.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:pistol/windows_explorer.py:81"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/wsl/bootstrap.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/wsl/bootstrap.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/wsl/bootstrap.py","line":110,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/wsl/bootstrap.py:110"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/wsl/bootstrap.py","line":113,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/wsl/bootstrap.py:113"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/wsl/bootstrap.py","line":118,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/wsl/bootstrap.py:118"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/wsl/bootstrap.py","line":133,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/wsl/bootstrap.py:133"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/wsl/services.py","line":7,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:pistol/wsl/services.py:7"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"pistol/wsl/terminal.py","line":21,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:pistol/wsl/terminal.py:21"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"pistol/wsl/terminal.py","line":110,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:pistol/wsl/terminal.py:110"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args","severity":"high","message":"Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium]","path":"pistol/wsl/terminal.py","line":110,"fingerprint":"python.lang.security.audit.dangerous-os-exec-tainted-env-args:pistol/wsl/terminal.py:110"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"pistol/wsl/web/app.js","line":86,"fingerprint":"javascript.lang.security.detect-insecure-websocket:pistol/wsl/web/app.js:86"},{"rule_id":"opengrep/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers","severity":"medium","message":"The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel. [confidence low]","path":"pistol/certificates.py","line":172,"fingerprint":"python.lang.security.audit.insecure-transport.ssl.no-set-ciphers:pistol/certificates.py:172"},{"rule_id":"opengrep/python.cryptography.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"pistol/certificates.py","line":202,"fingerprint":"python.cryptography.security.insecure-hash-algorithm-sha1:pistol/certificates.py:202"},{"rule_id":"opengrep/python.django.security.injection.tainted-url-host","severity":"medium","message":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources th [confidence low]","path":"pistol/wsl/server.py","line":43,"fingerprint":"python.django.security.injection.tainted-url-host:pistol/wsl/server.py:43"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"pistol/wsl/web/app.js","line":32,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:pistol/wsl/web/app.js:32"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"pistol/wsl/web/app.js","line":33,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:pistol/wsl/web/app.js:33"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"pistol/wsl/web/app.js","line":46,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:pistol/wsl/web/app.js:46"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"pistol/wsl/web/app.js","line":65,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:pistol/wsl/web/app.js:65"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"pistol/wsl/web/app.js","line":65,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:pistol/wsl/web/app.js:65"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"pistol/wsl/web/app.js","line":161,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:pistol/wsl/web/app.js:161"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-method","severity":"medium","message":"User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"pistol/wsl/web/app.js","line":165,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-method:pistol/wsl/web/app.js:165"}],"evidence":[],"data":{"rulesets":["python","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.8846,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":398.0,"function_nloc":6002.0,"mean_ccn":5.84,"p90_ccn":13.0,"complex_functions":30.0,"long_functions":3.0,"many_param_functions":0.0,"risky_nloc_share":0.4224},"findings":[],"evidence":[{"kind":"complex-function","description":"dispatch in pistol/cli.py: complexity 166, 886 lines","ref":"pistol/cli.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/cli.py#L799","weight":1.0},{"kind":"complex-function","description":"run in pistol/doctor.py: complexity 64, 101 lines","ref":"pistol/doctor.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/doctor.py#L76","weight":1.0},{"kind":"complex-function","description":"handler_for.forward in pistol/lecap_proxy.py: complexity 43, 64 lines","ref":"pistol/lecap_proxy.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/lecap_proxy.py#L117","weight":0.7166666666666667},{"kind":"complex-function","description":"access in pistol/access_commands.py: complexity 40, 68 lines","ref":"pistol/access_commands.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/access_commands.py#L78","weight":0.6666666666666666},{"kind":"complex-function","description":"run in pistol/shrimp.py: complexity 30, 54 lines","ref":"pistol/shrimp.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/shrimp.py#L199","weight":0.5},{"kind":"complex-function","description":"detect in pistol/utils/project.py: complexity 30, 42 lines","ref":"pistol/utils/project.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/utils/project.py#L88","weight":0.5},{"kind":"complex-function","description":"execute in pistol/wsl/bootstrap.py: complexity 30, 85 lines","ref":"pistol/wsl/bootstrap.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/wsl/bootstrap.py#L61","weight":0.5},{"kind":"complex-function","description":"render in pistol/shrimp.py: complexity 28, 29 lines","ref":"pistol/shrimp.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/shrimp.py#L255","weight":0.4666666666666667},{"kind":"complex-function","description":"run in pistol/lecap_worker.py: complexity 27, 71 lines","ref":"pistol/lecap_worker.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/lecap_worker.py#L23","weight":0.45},{"kind":"complex-function","description":"api in pistol/wsl/server.py: complexity 27, 73 lines","ref":"pistol/wsl/server.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/wsl/server.py#L83","weight":0.45}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":6729.0,"duplicated_lines":118.0,"duplicated_share":0.0175,"files":51.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: install.ps1:8 and install.ps1:724","ref":"install.ps1","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/install.ps1#L8","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: pistol/cli.py:1305 and pistol/cli.py:1346","ref":"pistol/cli.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/cli.py#L1305","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: pistol/config.py:71 and pistol/lecap_runtime.py:36","ref":"pistol/config.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/config.py#L71","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: pistol/explorer.py:56 and pistol/explorer.py:79","ref":"pistol/explorer.py","url":"https://github.com/rellek550/Pistol-CLI/blob/961d8b5d588361735a4ce18db29a1af1dbfc5e9a/pistol/explorer.py#L56","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":24.0,"weighted_findings":46.0,"scanned_lines":8240.0,"category:best-practice":20.0,"category:maintainability":4.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/config.py","line":89,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/config.py:89"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/fire.py","line":280,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/fire.py:280"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/lecap_runtime.py","line":54,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/lecap_runtime.py:54"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/lecap_runtime.py","line":238,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/lecap_runtime.py:238"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/lecap_runtime.py","line":286,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/lecap_runtime.py:286"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/lecap_worker.py","line":81,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/lecap_worker.py:81"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/watch.py","line":41,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/watch.py:41"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/wsl/bootstrap.py","line":57,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/wsl/bootstrap.py:57"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/wsl/bootstrap.py","line":145,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/wsl/bootstrap.py:145"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/wsl/manager.py","line":203,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/wsl/manager.py:203"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pistol/wsl/manager.py","line":239,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pistol/wsl/manager.py:239"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ip.is_loopback() because ip.is_loopback is always true.","path":"pistol/lecap_proxy.py","line":53,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:pistol/lecap_proxy.py:53"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(remote).is_loopback() because ipaddress.ip_address(remote).is_loopback is always true.","path":"pistol/lecap_proxy.py","line":132,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:pistol/lecap_proxy.py:132"},{"rule_id":"opengrep/python.lang.maintainability.useless-literal","severity":"medium","message":"key `\"dotenv\"` is uselessly assigned twice","path":"pistol/req.py","line":27,"fingerprint":"python.lang.maintainability.useless-literal:pistol/req.py:27"},{"rule_id":"opengrep/python.lang.maintainability.useless-literal","severity":"medium","message":"key `\"dotenv\"` is uselessly assigned twice","path":"pistol/req.py","line":40,"fingerprint":"python.lang.maintainability.useless-literal:pistol/req.py:40"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":53,"fingerprint":"javascript.lang.best-practice.javascript-confirm:pistol/wsl/web/app.js:53"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":57,"fingerprint":"javascript.lang.best-practice.javascript-confirm:pistol/wsl/web/app.js:57"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":97,"fingerprint":"javascript.lang.best-practice.javascript-confirm:pistol/wsl/web/app.js:97"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-prompt","severity":"medium","message":"found prompt() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":118,"fingerprint":"javascript.lang.best-practice.javascript-prompt:pistol/wsl/web/app.js:118"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":119,"fingerprint":"javascript.lang.best-practice.javascript-confirm:pistol/wsl/web/app.js:119"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-prompt","severity":"medium","message":"found prompt() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":126,"fingerprint":"javascript.lang.best-practice.javascript-prompt:pistol/wsl/web/app.js:126"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":139,"fingerprint":"javascript.lang.best-practice.javascript-confirm:pistol/wsl/web/app.js:139"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":144,"fingerprint":"javascript.lang.best-practice.javascript-confirm:pistol/wsl/web/app.js:144"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"pistol/wsl/web/app.js","line":149,"fingerprint":"javascript.lang.best-practice.javascript-confirm:pistol/wsl/web/app.js:149"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.5594,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":2584.0,"source_lines":9239.0,"test_ratio":0.2797,"ci_files":0.0,"cochange_share":0.5,"cochange_commits":4.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":196.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":4.0,"escapes_per_kloc":0.496},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}