{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:21:50.183052Z","repo":{"ref":{"host":"github.com","owner":"rgburke","name":"grv"},"default_branch":"master","clone_url":"https://github.com/rgburke/grv.git","html_url":"https://github.com/rgburke/grv","description":"GRV is a terminal interface for viewing git repositories","stars":4085,"forks":97,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":6838,"primary_language":"Go","license_spdx":"GPL-3.0","created_at":"2017-09-08T20:10:24Z","pushed_at":"2019-05-01T20:02:46Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-05-15T19:41:00Z","owner_type":"User","release_assets":[{"name":"grv-0.3.2-src.tar.gz","size":10321816,"download_count":543,"release_tag":"v0.3.2","url":"https://github.com/rgburke/grv/releases/download/v0.3.2/grv-0.3.2-src.tar.gz"},{"name":"grv_v0.3.2_linux64","size":12116016,"download_count":5347,"release_tag":"v0.3.2","url":"https://github.com/rgburke/grv/releases/download/v0.3.2/grv_v0.3.2_linux64"},{"name":"grv-0.3.1-src.tar.gz","size":10043957,"download_count":161,"release_tag":"v0.3.1","url":"https://github.com/rgburke/grv/releases/download/v0.3.1/grv-0.3.1-src.tar.gz"},{"name":"grv_v0.3.1_linux64","size":12083648,"download_count":568,"release_tag":"v0.3.1","url":"https://github.com/rgburke/grv/releases/download/v0.3.1/grv_v0.3.1_linux64"},{"name":"grv-0.3.0-src.tar.gz","size":9892527,"download_count":179,"release_tag":"v0.3.0","url":"https://github.com/rgburke/grv/releases/download/v0.3.0/grv-0.3.0-src.tar.gz"},{"name":"grv_v0.3.0_linux64","size":17321632,"download_count":1117,"release_tag":"v0.3.0","url":"https://github.com/rgburke/grv/releases/download/v0.3.0/grv_v0.3.0_linux64"},{"name":"grv-0.2.0-src.tar.gz","size":9717785,"download_count":340,"release_tag":"v0.2.0","url":"https://github.com/rgburke/grv/releases/download/v0.2.0/grv-0.2.0-src.tar.gz"},{"name":"grv_v0.2.0_linux64","size":16109288,"download_count":442,"release_tag":"v0.2.0","url":"https://github.com/rgburke/grv/releases/download/v0.2.0/grv_v0.2.0_linux64"},{"name":"grv-0.1.3-src.tar.gz","size":8368757,"download_count":163,"release_tag":"v0.1.3","url":"https://github.com/rgburke/grv/releases/download/v0.1.3/grv-0.1.3-src.tar.gz"},{"name":"grv_v0.1.3_linux64","size":15098304,"download_count":236,"release_tag":"v0.1.3","url":"https://github.com/rgburke/grv/releases/download/v0.1.3/grv_v0.1.3_linux64"},{"name":"grv_v0.1.3_linux64_kernel_2.6.24_support","size":13745359,"download_count":34,"release_tag":"v0.1.3","url":"https://github.com/rgburke/grv/releases/download/v0.1.3/grv_v0.1.3_linux64_kernel_2.6.24_support"},{"name":"grv_v0.1.3_linux_arm32","size":11110100,"download_count":35,"release_tag":"v0.1.3","url":"https://github.com/rgburke/grv/releases/download/v0.1.3/grv_v0.1.3_linux_arm32"},{"name":"grv-0.1.2-src.tar.gz","size":11606515,"download_count":77,"release_tag":"v0.1.2","url":"https://github.com/rgburke/grv/releases/download/v0.1.2/grv-0.1.2-src.tar.gz"},{"name":"grv_v0.1.2_linux64","size":16954744,"download_count":550,"release_tag":"v0.1.2","url":"https://github.com/rgburke/grv/releases/download/v0.1.2/grv_v0.1.2_linux64"},{"name":"grv_v0.1.2_linux64_kernel_2.6.24_support","size":13848434,"download_count":25,"release_tag":"v0.1.2","url":"https://github.com/rgburke/grv/releases/download/v0.1.2/grv_v0.1.2_linux64_kernel_2.6.24_support"},{"name":"grv_v0.1.2_linux_arm32","size":11156072,"download_count":40,"release_tag":"v0.1.2","url":"https://github.com/rgburke/grv/releases/download/v0.1.2/grv_v0.1.2_linux_arm32"},{"name":"grv-0.1.1-src.tar.gz","size":9159648,"download_count":42,"release_tag":"v0.1.1","url":"https://github.com/rgburke/grv/releases/download/v0.1.1/grv-0.1.1-src.tar.gz"},{"name":"grv_v0.1.1_arm32","size":10891532,"download_count":34,"release_tag":"v0.1.1","url":"https://github.com/rgburke/grv/releases/download/v0.1.1/grv_v0.1.1_arm32"},{"name":"grv_v0.1.1_linux64","size":16665808,"download_count":524,"release_tag":"v0.1.1","url":"https://github.com/rgburke/grv/releases/download/v0.1.1/grv_v0.1.1_linux64"},{"name":"grv_v0.1.1_linux64_kernel_2.6.24_support","size":13581241,"download_count":29,"release_tag":"v0.1.1","url":"https://github.com/rgburke/grv/releases/download/v0.1.1/grv_v0.1.1_linux64_kernel_2.6.24_support"},{"name":"grv_v0.1.0_arm32","size":10879748,"download_count":54,"release_tag":"v0.1.0","url":"https://github.com/rgburke/grv/releases/download/v0.1.0/grv_v0.1.0_arm32"},{"name":"grv_v0.1.0_linux64","size":16657792,"download_count":1374,"release_tag":"v0.1.0","url":"https://github.com/rgburke/grv/releases/download/v0.1.0/grv_v0.1.0_linux64"},{"name":"grv_v0.1.0_linux64_kernel_2.6.24_support","size":13569122,"download_count":39,"release_tag":"v0.1.0","url":"https://github.com/rgburke/grv/releases/download/v0.1.0/grv_v0.1.0_linux64_kernel_2.6.24_support"}]}},"commit_sha":"cffa246f92566fa385373cee82349f84d7c28212","profile":{"lines_by_language":{"Go":36229},"files_by_category":{"source":64,"test":19,"binary":8,"docs":4,"config":3,"other":2,"oversized":1},"source_lines":28310,"test_lines":7919},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":69.3,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":66.1,"duplication":87.0,"lint":92.4,"testing":76.9,"docs":65.0,"type_safety":null,"process":0.0},"summary":"Code quality is adequate: test-to-source ratio 0.28, CI runs tests; 14% of function code in complex or long functions; 2% duplicated lines. Weakest area: process."},"security":{"score":69.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":92.0,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":20.0},"summary":"Security posture is weak: 5 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":1.7,"check:Code-Review":0.0,"check:Maintained":0.0,"check:SAST":0.0,"check:Binary-Artifacts":10.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:Fuzzing":0.0,"check:License":10.0,"check:Signed-Releases":0.0,"check:Branch-Protection":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 0/10 (Found 0/30 approved changesets -- score normalized to 0)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (no SAST tool detected)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Signed-Releases: 0/10 (Project has not signed or included provenance with any releases.)","ref":"Signed-Releases","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/rgburke/grv","weight":1.0}],"data":{"date":"2026-11-02","commit":"cffa246f92566fa385373cee82349f84d7c28212","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":579.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":51602.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2017-01":{"loc":991,"attributed_loc":0},"2017-02":{"loc":1637,"attributed_loc":0},"2017-03":{"loc":3175,"attributed_loc":0},"2017-04":{"loc":2196,"attributed_loc":0},"2017-05":{"loc":1498,"attributed_loc":0},"2017-06":{"loc":2000,"attributed_loc":0},"2017-07":{"loc":4795,"attributed_loc":0},"2017-08":{"loc":5330,"attributed_loc":0},"2017-09":{"loc":1719,"attributed_loc":0},"2017-10":{"loc":2060,"attributed_loc":0},"2017-11":{"loc":1425,"attributed_loc":0},"2017-12":{"loc":1417,"attributed_loc":0},"2018-01":{"loc":1662,"attributed_loc":0},"2018-02":{"loc":1040,"attributed_loc":0},"2018-03":{"loc":2091,"attributed_loc":0},"2018-04":{"loc":1886,"attributed_loc":0},"2018-05":{"loc":3910,"attributed_loc":0},"2018-06":{"loc":4138,"attributed_loc":0},"2018-07":{"loc":2026,"attributed_loc":0},"2018-08":{"loc":1139,"attributed_loc":0},"2018-09":{"loc":2495,"attributed_loc":0},"2018-10":{"loc":1,"attributed_loc":0},"2018-12":{"loc":774,"attributed_loc":0},"2019-01":{"loc":908,"attributed_loc":0},"2019-02":{"loc":782,"attributed_loc":0},"2019-03":{"loc":388,"attributed_loc":0},"2019-04":{"loc":7,"attributed_loc":0},"2019-05":{"loc":112,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":388.0,"flagged_units":0.0,"pre_ai_era_bursts":1.0,"pre_ai_era_measured_loc":51602.0,"pre_ai_era_burst_loc":2426.0,"measured_loc":51602.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":606.5,"median_loc_per_hour":45.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":7.0,"flagged_releases":0.0,"max_loc_per_day":93.4},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1.0","to":"v0.1.1","loc":208,"days":3.93,"loc_per_day":53.0,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":116,"days":4.97,"loc_per_day":23.3,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":1783,"days":27.09,"loc_per_day":65.8,"flagged":false},{"from":"v0.1.3","to":"v0.2.0","loc":10231,"days":109.5,"loc_per_day":93.4,"flagged":false},{"from":"v0.2.0","to":"v0.3.0","loc":6208,"days":96.96,"loc_per_day":64.0,"flagged":false},{"from":"v0.3.0","to":"v0.3.1","loc":1442,"days":101.54,"loc_per_day":14.2,"flagged":false},{"from":"v0.3.1","to":"v0.3.2","loc":1573,"days":65.98,"loc_per_day":23.8,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":28310.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":17.0,"findings_high":5.0,"findings_medium":12.0,"findings_low":0.0,"weighted_findings":6.75,"scanned_lines":28310.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd/grv/git_command_repo_controller.go","line":292,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd/grv/git_command_repo_controller.go:292"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd/grv/grv.go","line":525,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd/grv/grv.go:525"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd/grv/grv.go","line":527,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd/grv/grv.go:527"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd/grv/repo_data_loader.go","line":1430,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd/grv/repo_data_loader.go:1430"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd/grv/repo_data_loader.go","line":1439,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd/grv/repo_data_loader.go:1439"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/readline.go","line":145,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/readline.go:145"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/readline.go","line":160,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/readline.go:160"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/readline.go","line":182,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/readline.go:182"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/readline.go","line":185,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/readline.go:185"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/readline.go","line":310,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/readline.go:310"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/ui.go","line":215,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/ui.go:215"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/ui.go","line":318,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/ui.go:318"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/ui.go","line":517,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/ui.go:517"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/ui.go","line":519,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/ui.go:519"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/ui.go","line":798,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/ui.go:798"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/ui.go","line":802,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/ui.go:802"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"cmd/grv/ui.go","line":806,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:cmd/grv/ui.go:806"}],"evidence":[],"data":{"rulesets":["go"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.02,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":7.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.3.2 ships grv-0.3.2-src.tar.gz (543 downloads)","ref":"grv-0.3.2-src.tar.gz","url":"https://github.com/rgburke/grv/releases/download/v0.3.2/grv-0.3.2-src.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.3.1 ships grv-0.3.1-src.tar.gz (161 downloads)","ref":"grv-0.3.1-src.tar.gz","url":"https://github.com/rgburke/grv/releases/download/v0.3.1/grv-0.3.1-src.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.3.0 ships grv-0.3.0-src.tar.gz (179 downloads)","ref":"grv-0.3.0-src.tar.gz","url":"https://github.com/rgburke/grv/releases/download/v0.3.0/grv-0.3.0-src.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.2.0 ships grv-0.2.0-src.tar.gz (340 downloads)","ref":"grv-0.2.0-src.tar.gz","url":"https://github.com/rgburke/grv/releases/download/v0.2.0/grv-0.2.0-src.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.1.3 ships grv-0.1.3-src.tar.gz (163 downloads)","ref":"grv-0.1.3-src.tar.gz","url":"https://github.com/rgburke/grv/releases/download/v0.1.3/grv-0.1.3-src.tar.gz","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1527.0,"function_nloc":18254.0,"mean_ccn":2.78,"p90_ccn":6.0,"complex_functions":23.0,"long_functions":4.0,"many_param_functions":0.0,"risky_nloc_share":0.1381},"findings":[],"evidence":[{"kind":"complex-function","description":"Scan in cmd/grv/query_scan.go: complexity 35, 127 lines","ref":"cmd/grv/query_scan.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/query_scan.go#L149","weight":0.5833333333333334},{"kind":"complex-function","description":"generateDiffLinesForDiff in cmd/grv/diff_view.go: complexity 26, 107 lines","ref":"cmd/grv/diff_view.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/diff_view.go#L644","weight":0.43333333333333335},{"kind":"complex-function","description":"processDiffHeader in cmd/grv/fancy_diff_view.go: complexity 23, 98 lines","ref":"cmd/grv/fancy_diff_view.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/fancy_diff_view.go#L95","weight":0.38333333333333336},{"kind":"complex-function","description":"HandleAction in cmd/grv/view.go: complexity 23, 82 lines","ref":"cmd/grv/view.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/view.go#L518","weight":0.38333333333333336},{"kind":"complex-function","description":"Scan in cmd/grv/config_scan.go: complexity 22, 69 lines","ref":"cmd/grv/config_scan.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/config_scan.go#L206","weight":0.36666666666666664},{"kind":"complex-function","description":"runHandlerLoop in cmd/grv/grv.go: complexity 22, 66 lines","ref":"cmd/grv/grv.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/grv.go#L440","weight":0.36666666666666664},{"kind":"complex-function","description":"Render in cmd/grv/commit_view.go: complexity 20, 84 lines","ref":"cmd/grv/commit_view.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/commit_view.go#L135","weight":0.3333333333333333},{"kind":"complex-function","description":"scanWhiteSpace in cmd/grv/config_scan.go: complexity 20, 70 lines","ref":"cmd/grv/config_scan.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/config_scan.go#L289","weight":0.3333333333333333},{"kind":"complex-function","description":"updateRefs in cmd/grv/repo_data.go: complexity 19, 83 lines","ref":"cmd/grv/repo_data.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/repo_data.go#L425","weight":0.31666666666666665},{"kind":"complex-function","description":"processCommand in cmd/grv/config.go: complexity 18, 41 lines","ref":"cmd/grv/config.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/config.go#L533","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":18045.0,"duplicated_lines":419.0,"duplicated_share":0.0232,"files":64.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/commit_view.go:907 and cmd/grv/ref_view.go:978","ref":"cmd/grv/commit_view.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/commit_view.go#L907","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/config_scan.go:4 and cmd/grv/query_scan.go:4","ref":"cmd/grv/config_scan.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/config_scan.go#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/config_scan.go:295 and cmd/grv/config_scan.go:475","ref":"cmd/grv/config_scan.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/config_scan.go#L295","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/git_summary_view.go:183 and cmd/grv/remote_view.go:14","ref":"cmd/grv/git_summary_view.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/git_summary_view.go#L183","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/query_parse.go:368 and cmd/grv/query_parse.go:425","ref":"cmd/grv/query_parse.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/query_parse.go#L368","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/query_scan.go:311 and cmd/grv/query_scan.go:394","ref":"cmd/grv/query_scan.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/query_scan.go#L311","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/repo_data.go:713 and cmd/grv/repo_data.go:732","ref":"cmd/grv/repo_data.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/repo_data.go#L713","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/repo_data_loader.go:715 and cmd/grv/repo_data_loader.go:757","ref":"cmd/grv/repo_data_loader.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/repo_data_loader.go#L715","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/table_formatter.go:272 and cmd/grv/table_formatter.go:371","ref":"cmd/grv/table_formatter.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/table_formatter.go#L272","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/grv/themes.go:367 and cmd/grv/themes.go:855","ref":"cmd/grv/themes.go","url":"https://github.com/rgburke/grv/blob/cffa246f92566fa385373cee82349f84d7c28212/cmd/grv/themes.go#L367","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"weighted_findings":9.0,"scanned_lines":28310.0,"category:best-practice":6.0,"category:correctness":3.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/grv/config.go","line":456,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/grv/config.go:456"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"cmd/grv/git_command_repo_controller.go","line":35,"fingerprint":"go.lang.best-practice.hidden-goroutine:cmd/grv/git_command_repo_controller.go:35"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"cmd/grv/git_command_repo_controller.go","line":47,"fingerprint":"go.lang.best-practice.hidden-goroutine:cmd/grv/git_command_repo_controller.go:47"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"cmd/grv/git_command_repo_controller.go","line":109,"fingerprint":"go.lang.best-practice.hidden-goroutine:cmd/grv/git_command_repo_controller.go:109"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/grv/git_command_repo_controller.go","line":164,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/grv/git_command_repo_controller.go:164"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"cmd/grv/git_command_repo_controller.go","line":202,"fingerprint":"go.lang.best-practice.hidden-goroutine:cmd/grv/git_command_repo_controller.go:202"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"cmd/grv/git_command_repo_controller.go","line":209,"fingerprint":"go.lang.best-practice.hidden-goroutine:cmd/grv/git_command_repo_controller.go:209"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"cmd/grv/git_command_repo_controller.go","line":236,"fingerprint":"go.lang.best-practice.hidden-goroutine:cmd/grv/git_command_repo_controller.go:236"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/grv/log.go","line":91,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/grv/log.go:91"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.5594,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.7901,"test_lines":7919.0,"source_lines":28310.0,"test_ratio":0.2797,"ci_files":1.0,"cochange_share":0.1975,"cochange_commits":243.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (make test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["make test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":69.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}