{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.125634Z","repo":{"ref":{"host":"github.com","owner":"repied","name":"Analyseur-ipd"},"default_branch":"main","clone_url":"https://github.com/repied/Analyseur-ipd.git","html_url":"https://github.com/repied/Analyseur-ipd","description":null,"stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":272,"primary_language":"JavaScript","license_spdx":null,"created_at":"2026-03-08T14:11:44Z","pushed_at":"2026-03-12T19:01:37Z","security_policy_url":null,"distribution":{"owner_created_at":"2015-11-09T22:18:34Z","owner_type":"User","release_assets":[]}},"commit_sha":"2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4","profile":{"lines_by_language":{"JavaScript":13002,"TypeScript":25,"Shell":14},"files_by_category":{"source":7,"other":4,"config":3,"test":2,"docs":1,"binary":1,"generated":1},"source_lines":12932,"test_lines":109},"pillars":{"ai_provenance":{"score":98.1,"confidence":0.76,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.9814,"suspected_share":0.0,"estimated_share":0.9814,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":0.503},"summary":"Explicit AI attribution on 98% of first-party code added; an estimated 98% including velocity signals."},"quality":{"score":36.5,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":8.6,"duplication":49.1,"lint":89.5,"testing":25.4,"docs":20.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.01, no CI test run detected; 82% of function code in complex or long functions; 12% duplicated lines. Weakest area: complexity."},"security":{"score":50.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":65.9,"sast":77.9,"dependencies":30.1,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 46 known vulnerabilities in 10 dependencies; 10 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":10.0,"checked":10.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":24.0,"attributed_commits":14.0,"attributed_commit_share":0.5833333333333334,"effective_loc":13298.0,"attributed_loc":13050.0,"attributed_loc_share":0.9813505790344412,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 12 attributed commits, 13,050 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Jules: 2 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4","url":"https://github.com/repied/Analyseur-ipd/commit/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"3678e8582eb85941429a681798b411eff16c73aa","url":"https://github.com/repied/Analyseur-ipd/commit/3678e8582eb85941429a681798b411eff16c73aa","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"84c3821ecb9f3cb21a98df76151fe87f5d0b4728","url":"https://github.com/repied/Analyseur-ipd/commit/84c3821ecb9f3cb21a98df76151fe87f5d0b4728","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"24ef7185112ba0d6885fe3437662c45d1a02a5c9","url":"https://github.com/repied/Analyseur-ipd/commit/24ef7185112ba0d6885fe3437662c45d1a02a5c9","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"6b37ac67d5ba35daaf66d6f00496d4d8486f0bdc","url":"https://github.com/repied/Analyseur-ipd/commit/6b37ac67d5ba35daaf66d6f00496d4d8486f0bdc","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"4496dadd4e9b880ee09de4f4508015d3c906cf94","url":"https://github.com/repied/Analyseur-ipd/commit/4496dadd4e9b880ee09de4f4508015d3c906cf94","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"b5a0deecc3a9ff0791e367ffced90d89d0aeac49","url":"https://github.com/repied/Analyseur-ipd/commit/b5a0deecc3a9ff0791e367ffced90d89d0aeac49","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"171299c705172e8e021e414f4e9934705bda1d52","url":"https://github.com/repied/Analyseur-ipd/commit/171299c705172e8e021e414f4e9934705bda1d52","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"9af5594e5d99075dea289cd96a7f5326ccdb1ab9","url":"https://github.com/repied/Analyseur-ipd/commit/9af5594e5d99075dea289cd96a7f5326ccdb1ab9","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"d07ed228a466668ce624bb39dcfbb1aed572a25a","url":"https://github.com/repied/Analyseur-ipd/commit/d07ed228a466668ce624bb39dcfbb1aed572a25a","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"e65fabdda02bf32da5afe39dd3242af123bad699","url":"https://github.com/repied/Analyseur-ipd/commit/e65fabdda02bf32da5afe39dd3242af123bad699","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"c902f8447fdb270bb49cf460c89b2a1c2b72a27c","url":"https://github.com/repied/Analyseur-ipd/commit/c902f8447fdb270bb49cf460c89b2a1c2b72a27c","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"fb33b9d9e74dc2ff924fe7c8925a7f170a20f199","url":"https://github.com/repied/Analyseur-ipd/commit/fb33b9d9e74dc2ff924fe7c8925a7f170a20f199","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"aed6c331a8cef769baf8cc5ff9523cd99ca51149","url":"https://github.com/repied/Analyseur-ipd/commit/aed6c331a8cef769baf8cc5ff9523cd99ca51149","weight":0.9}],"data":{"attributed_loc_by_commit":{"aed6c331a8cef769baf8cc5ff9523cd99ca51149":0,"fb33b9d9e74dc2ff924fe7c8925a7f170a20f199":0,"c902f8447fdb270bb49cf460c89b2a1c2b72a27c":637,"e65fabdda02bf32da5afe39dd3242af123bad699":11085,"d07ed228a466668ce624bb39dcfbb1aed572a25a":103,"9af5594e5d99075dea289cd96a7f5326ccdb1ab9":26,"171299c705172e8e021e414f4e9934705bda1d52":38,"b5a0deecc3a9ff0791e367ffced90d89d0aeac49":77,"4496dadd4e9b880ee09de4f4508015d3c906cf94":0,"6b37ac67d5ba35daaf66d6f00496d4d8486f0bdc":91,"24ef7185112ba0d6885fe3437662c45d1a02a5c9":15,"84c3821ecb9f3cb21a98df76151fe87f5d0b4728":22,"3678e8582eb85941429a681798b411eff16c73aa":680,"2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4":276},"tools":{"jules":{"name":"Jules","commits":2,"loc":0,"first_seen":1772986293,"last_seen":1773006636},"github-copilot":{"name":"GitHub Copilot coding agent","commits":12,"loc":13050,"first_seen":1773061948,"last_seen":1773342093}},"monthly":{"2026-03":{"loc":13298,"attributed_loc":13050}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":6.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":13298.0,"flagged_loc":11329.0,"flagged_loc_share":0.8519326214468341,"max_loc_per_hour":2243.242945932567,"median_loc_per_hour":137.68951612903226,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"11,329 lines of first-party code in ~5.1h (2,243 lines/hour, 5 commit session)","ref":"b5a0deecc3a9ff0791e367ffced90d89d0aeac49","url":"https://github.com/repied/Analyseur-ipd/commit/b5a0deecc3a9ff0791e367ffced90d89d0aeac49","weight":0.6}],"data":{"flagged_loc_by_commit":{"e65fabdda02bf32da5afe39dd3242af123bad699":11085,"d07ed228a466668ce624bb39dcfbb1aed572a25a":103,"9af5594e5d99075dea289cd96a7f5326ccdb1ab9":26,"171299c705172e8e021e414f4e9934705bda1d52":38,"b5a0deecc3a9ff0791e367ffced90d89d0aeac49":77},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":12932.0,"index":0.503,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.077,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":11.0,"per_kloc:emoji_in_code":0.851,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Finally, search either indexOf (if dir is true) or lastIndexOf","ref":"src/js/fit-parser.bundle.js:870","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L870","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":1.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/gcp-api-key","severity":"high","message":"Possible gcp-api-key secret in the current tree","path":"src/js/app.js","line":580,"fingerprint":"src/js/app.js:gcp-api-key:580"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":17.0,"findings_high":10.0,"findings_medium":7.0,"findings_low":0.0,"weighted_findings":9.25,"scanned_lines":12932.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":387,"fingerprint":"javascript.browser.security.insecure-document-method:src/js/app.js:387"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById('statMaxDepth').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":387,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/js/app.js:387"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":388,"fingerprint":"javascript.browser.security.insecure-document-method:src/js/app.js:388"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `document.getElementById('statDuration').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":388,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/js/app.js:388"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":447,"fingerprint":"javascript.browser.security.insecure-document-method:src/js/app.js:447"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `card.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":447,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/js/app.js:447"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":640,"fingerprint":"javascript.browser.security.insecure-document-method:src/js/app.js:640"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `resultDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":640,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/js/app.js:640"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":645,"fingerprint":"javascript.browser.security.insecure-document-method:src/js/app.js:645"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `resultDiv.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/js/app.js","line":645,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/js/app.js:645"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/js/app.js","line":387,"fingerprint":"javascript.lang.security.html-in-template-string:src/js/app.js:387"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/js/app.js","line":388,"fingerprint":"javascript.lang.security.html-in-template-string:src/js/app.js:388"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/js/app.js","line":444,"fingerprint":"javascript.lang.security.html-in-template-string:src/js/app.js:444"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/js/app.js","line":447,"fingerprint":"javascript.lang.security.html-in-template-string:src/js/app.js:447"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/js/app.js","line":645,"fingerprint":"javascript.lang.security.html-in-template-string:src/js/app.js:645"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/js/app.js","line":673,"fingerprint":"javascript.lang.security.html-in-template-string:src/js/app.js:673"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/js/app.js","line":684,"fingerprint":"javascript.lang.security.html-in-template-string:src/js/app.js:684"}],"evidence":[],"data":{"rulesets":["javascript","typescript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":10.0,"vulnerabilities":46.0,"vulns_critical":1.0,"vulns_high":15.0,"vulns_medium":25.0,"vulns_low":5.0,"vulns_unknown":0.0,"penalty":72.0},"findings":[{"rule_id":"osv/GHSA-xv26-6w52-cph6","severity":"critical","message":"websocket-driver@0.7.4 (npm) is affected by GHSA-xv26-6w52-cph6","path":"package-lock.json","line":null,"fingerprint":"websocket-driver@0.7.4 (npm):GHSA-xv26-6w52-cph6"},{"rule_id":"osv/GHSA-grv7-fg5c-xmjg","severity":"high","message":"braces@2.3.2 (npm) is affected by GHSA-grv7-fg5c-xmjg","path":"package-lock.json","line":null,"fingerprint":"braces@2.3.2 (npm):GHSA-grv7-fg5c-xmjg"},{"rule_id":"osv/GHSA-qr28-fpjm-wq7f","severity":"high","message":"decode-uri-component@0.2.2 (npm) is affected by GHSA-qr28-fpjm-wq7f","path":"package-lock.json","line":null,"fingerprint":"decode-uri-component@0.2.2 (npm):GHSA-qr28-fpjm-wq7f"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.3 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4cwx-7wf7-3272","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-4cwx-7wf7-3272","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-4cwx-7wf7-3272"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-f269-vfmq-vjvj","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-f269-vfmq-vjvj","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-f269-vfmq-vjvj"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-v9p9-hfj2-hcw8","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-v9p9-hfj2-hcw8","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-v9p9-hfj2-hcw8"},{"rule_id":"osv/GHSA-vrm6-8vpv-qv8q","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-vrm6-8vpv-qv8q","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-vrm6-8vpv-qv8q"},{"rule_id":"osv/GHSA-vxpw-j846-p89q","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-vxpw-j846-p89q","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-vxpw-j846-p89q"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.22.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@3.4.0 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"package-lock.json","line":null,"fingerprint":"uuid@3.4.0 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-vcc3-ghjq-m6fr","severity":"medium","message":"decode-uri-component@0.2.2 (npm) is affected by GHSA-vcc3-ghjq-m6fr","path":"package-lock.json","line":null,"fingerprint":"decode-uri-component@0.2.2 (npm):GHSA-vcc3-ghjq-m6fr"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-952p-6rrq-rcjv","severity":"medium","message":"micromatch@3.1.10 (npm) is affected by GHSA-952p-6rrq-rcjv","path":"package-lock.json","line":null,"fingerprint":"micromatch@3.1.10 (npm):GHSA-952p-6rrq-rcjv"},{"rule_id":"osv/GHSA-4vj7-5mj6-jm8m","severity":"medium","message":"morgan@1.10.1 (npm) is affected by GHSA-4vj7-5mj6-jm8m","path":"package-lock.json","line":null,"fingerprint":"morgan@1.10.1 (npm):GHSA-4vj7-5mj6-jm8m"},{"rule_id":"osv/GHSA-9f6g-j8ch-79g4","severity":"medium","message":"morgan@1.10.1 (npm) is affected by GHSA-9f6g-j8ch-79g4","path":"package-lock.json","line":null,"fingerprint":"morgan@1.10.1 (npm):GHSA-9f6g-j8ch-79g4"},{"rule_id":"osv/GHSA-jxfw-x594-9x9m","severity":"medium","message":"morgan@1.10.1 (npm) is affected by GHSA-jxfw-x594-9x9m","path":"package-lock.json","line":null,"fingerprint":"morgan@1.10.1 (npm):GHSA-jxfw-x594-9x9m"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.3 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-2jfj-6hjv-fm6j","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-2jfj-6hjv-fm6j","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-2jfj-6hjv-fm6j"},{"rule_id":"osv/GHSA-2mjp-6q6p-2qxm","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-2mjp-6q6p-2qxm","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-2mjp-6q6p-2qxm"},{"rule_id":"osv/GHSA-3xpg-4rpp-hhhm","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-3xpg-4rpp-hhhm","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-3xpg-4rpp-hhhm"},{"rule_id":"osv/GHSA-4992-7rv2-5pvq","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-4992-7rv2-5pvq","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-4992-7rv2-5pvq"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-8xcm-r25x-g524","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-8xcm-r25x-g524","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-8xcm-r25x-g524"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-f72v-6w45-q472","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-jr45-8vmc-qm54","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-jr45-8vmc-qm54","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-jr45-8vmc-qm54"},{"rule_id":"osv/GHSA-m8rv-5g2x-5cg5","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-m8rv-5g2x-5cg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-m8rv-5g2x-5cg5"},{"rule_id":"osv/GHSA-p88m-4jfj-68fv","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-p88m-4jfj-68fv","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-p88m-4jfj-68fv"},{"rule_id":"osv/GHSA-phc3-fgpg-7m6h","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-phc3-fgpg-7m6h","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-phc3-fgpg-7m6h"},{"rule_id":"osv/GHSA-pmjh-fq2x-6v4x","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-pmjh-fq2x-6v4x","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-pmjh-fq2x-6v4x"},{"rule_id":"osv/GHSA-pr7r-676h-xcf6","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-pr7r-676h-xcf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-pr7r-676h-xcf6"},{"rule_id":"osv/GHSA-rx4f-c7p8-82vq","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-rx4f-c7p8-82vq","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-rx4f-c7p8-82vq"},{"rule_id":"osv/GHSA-v3r7-h72x-cjcm","severity":"medium","message":"undici@7.22.0 (npm) is affected by GHSA-v3r7-h72x-cjcm","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-v3r7-h72x-cjcm"},{"rule_id":"osv/GHSA-mp7j-qc5w-4988","severity":"medium","message":"websocket-driver@0.7.4 (npm) is affected by GHSA-mp7j-qc5w-4988","path":"package-lock.json","line":null,"fingerprint":"websocket-driver@0.7.4 (npm):GHSA-mp7j-qc5w-4988"},{"rule_id":"osv/GHSA-2gqq-gqf2-x968","severity":"low","message":"undici@7.22.0 (npm) is affected by GHSA-2gqq-gqf2-x968","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-2gqq-gqf2-x968"},{"rule_id":"osv/GHSA-35p6-xmwp-9g52","severity":"low","message":"undici@7.22.0 (npm) is affected by GHSA-35p6-xmwp-9g52","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-35p6-xmwp-9g52"},{"rule_id":"osv/GHSA-8436-99hf-9mmv","severity":"low","message":"undici@7.22.0 (npm) is affected by GHSA-8436-99hf-9mmv","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-8436-99hf-9mmv"},{"rule_id":"osv/GHSA-g8m3-5g58-fq7m","severity":"low","message":"undici@7.22.0 (npm) is affected by GHSA-g8m3-5g58-fq7m","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-g8m3-5g58-fq7m"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@7.22.0 (npm) is affected by GHSA-r53p-7pc4-xj5r","path":"package-lock.json","line":null,"fingerprint":"undici@7.22.0 (npm):GHSA-r53p-7pc4-xj5r"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.25,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":233.0,"function_nloc":11792.0,"mean_ccn":4.99,"p90_ccn":11.0,"complex_functions":18.0,"long_functions":3.0,"many_param_functions":0.0,"risky_nloc_share":0.8181},"findings":[],"evidence":[{"kind":"complex-function","description":"parse in src/js/fit-parser.bundle.js: complexity 54, 223 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L10848","weight":0.9},{"kind":"complex-function","description":"applyOptions in src/js/fit-parser.bundle.js: complexity 54, 70 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L10498","weight":0.9},{"kind":"complex-function","description":"readRecord in src/js/fit-parser.bundle.js: complexity 33, 140 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L10568","weight":0.55},{"kind":"complex-function","description":"write in src/js/fit-parser.bundle.js: complexity 27, 56 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L1008","weight":0.45},{"kind":"complex-function","description":"readData in src/js/fit-parser.bundle.js: complexity 26, 76 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L10317","weight":0.43333333333333335},{"kind":"complex-function","description":"utf8Slice in src/js/fit-parser.bundle.js: complexity 25, 63 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L1095","weight":0.4166666666666667},{"kind":"complex-function","description":"copy in src/js/fit-parser.bundle.js: complexity 24, 36 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L1708","weight":0.4},{"kind":"complex-function","description":"byteLength in src/js/fit-parser.bundle.js: complexity 22, 40 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L583","weight":0.36666666666666664},{"kind":"complex-function","description":"slowToString in src/js/fit-parser.bundle.js: complexity 22, 46 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L628","weight":0.36666666666666664},{"kind":"complex-function","description":"formatByType in src/js/fit-parser.bundle.js: complexity 22, 51 lines","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L10393","weight":0.36666666666666664}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":10747.0,"duplicated_lines":1276.0,"duplicated_share":0.1187,"files":7.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: implement_shearwater.js:4 and patch_shearwater.js:2","ref":"implement_shearwater.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/implement_shearwater.js#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: implement_shearwater.js:10 and patch_garmin.js:12","ref":"implement_shearwater.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/implement_shearwater.js#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: implement_shearwater.js:14 and src/js/app.js:713","ref":"implement_shearwater.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/implement_shearwater.js#L14","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: patch_garmin.js:11 and src/js/app.js:973","ref":"patch_garmin.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/patch_garmin.js#L11","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/js/fit-parser.bundle.js:1278 and src/js/fit-parser.bundle.js:1342","ref":"src/js/fit-parser.bundle.js","url":"https://github.com/repied/Analyseur-ipd/blob/2f2c0d8ac54ce4ac1c1aee533c3734fdbdaf95b4/src/js/fit-parser.bundle.js#L1278","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":11.0,"weighted_findings":5.75,"scanned_lines":12932.0,"category:best-practice":1.0,"category:correctness":10.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/js/app.js","line":583,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/js/app.js:583"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/js/app.js","line":634,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/js/app.js:634"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/js/app.js","line":634,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/js/app.js:634"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/js/app.js","line":639,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/js/app.js:639"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"implement_shearwater.js","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:implement_shearwater.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"implement_shearwater.js","line":3,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:implement_shearwater.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"patch_garmin.js","line":10,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:patch_garmin.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"patch_garmin.js","line":10,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:patch_garmin.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`arr[L++]` is assigned twice; the first assignment is useless","path":"src/js/fit-parser.bundle.js","line":52,"fingerprint":"javascript.lang.correctness.useless-assignment:src/js/fit-parser.bundle.js:52"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`arr[L++]` is assigned twice; the first assignment is useless","path":"src/js/fit-parser.bundle.js","line":53,"fingerprint":"javascript.lang.correctness.useless-assignment:src/js/fit-parser.bundle.js:53"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`arr[L++]` is assigned twice; the first assignment is useless","path":"src/js/fit-parser.bundle.js","line":62,"fingerprint":"javascript.lang.correctness.useless-assignment:src/js/fit-parser.bundle.js:62"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0169,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.5,"test_lines":109.0,"source_lines":12932.0,"test_ratio":0.0084,"ci_files":0.0,"cochange_share":0.125,"cochange_commits":16.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":0.5,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":3.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":12706.0,"other_lines":226.0,"files_blamed":7.0,"blame_failures":0.0,"quality:ai_findings":11.0,"quality:ai_per_kloc":0.866,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":18.0,"security:ai_per_kloc":1.417,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}