{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.463294Z","repo":{"ref":{"host":"github.com","owner":"rubysherpas","name":"forem"},"default_branch":"rails4","clone_url":"https://github.com/rubysherpas/forem.git","html_url":"https://github.com/rubysherpas/forem","description":"The best Rails 3 and Rails 4 forum engine. Ever.","stars":1547,"forks":407,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":26474,"primary_language":"Ruby","license_spdx":"MIT","created_at":"2011-02-20T21:16:22Z","pushed_at":"2016-10-05T12:45:05Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-10-26T03:00:07Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"fb37858a51cfc8fe2ccd113e61af42546091fd27","profile":{"lines_by_language":{"Ruby":6106,"JavaScript":3},"files_by_category":{"source":96,"test":82,"other":53,"config":30,"docs":2,"binary":1},"source_lines":2548,"test_lines":3561},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":93.9,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":100.0,"duplication":100.0,"lint":95.2,"testing":90.0,"docs":80.0,"type_safety":null,"process":null},"summary":"Code quality is strong: test-to-source ratio 1.40, CI runs tests; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: docs."},"security":{"score":51.2,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":19.9,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1302.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":30643.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2011-02":{"loc":19573,"attributed_loc":0},"2011-03":{"loc":534,"attributed_loc":0},"2011-05":{"loc":317,"attributed_loc":0},"2011-06":{"loc":638,"attributed_loc":0},"2011-07":{"loc":75,"attributed_loc":0},"2011-08":{"loc":78,"attributed_loc":0},"2011-09":{"loc":310,"attributed_loc":0},"2011-10":{"loc":525,"attributed_loc":0},"2011-11":{"loc":1746,"attributed_loc":0},"2011-12":{"loc":582,"attributed_loc":0},"2012-01":{"loc":331,"attributed_loc":0},"2012-02":{"loc":1590,"attributed_loc":0},"2012-03":{"loc":442,"attributed_loc":0},"2012-04":{"loc":316,"attributed_loc":0},"2012-05":{"loc":48,"attributed_loc":0},"2012-06":{"loc":342,"attributed_loc":0},"2012-07":{"loc":170,"attributed_loc":0},"2012-08":{"loc":46,"attributed_loc":0},"2012-09":{"loc":172,"attributed_loc":0},"2012-10":{"loc":178,"attributed_loc":0},"2012-11":{"loc":199,"attributed_loc":0},"2012-12":{"loc":70,"attributed_loc":0},"2013-01":{"loc":257,"attributed_loc":0},"2013-02":{"loc":13,"attributed_loc":0},"2013-03":{"loc":0,"attributed_loc":0},"2013-04":{"loc":64,"attributed_loc":0},"2013-05":{"loc":362,"attributed_loc":0},"2013-06":{"loc":62,"attributed_loc":0},"2013-07":{"loc":136,"attributed_loc":0},"2013-08":{"loc":0,"attributed_loc":0},"2013-09":{"loc":119,"attributed_loc":0},"2013-10":{"loc":3,"attributed_loc":0},"2013-11":{"loc":119,"attributed_loc":0},"2013-12":{"loc":23,"attributed_loc":0},"2014-01":{"loc":116,"attributed_loc":0},"2014-02":{"loc":34,"attributed_loc":0},"2014-03":{"loc":217,"attributed_loc":0},"2014-04":{"loc":1,"attributed_loc":0},"2014-05":{"loc":17,"attributed_loc":0},"2014-06":{"loc":0,"attributed_loc":0},"2014-07":{"loc":0,"attributed_loc":0},"2014-08":{"loc":5,"attributed_loc":0},"2014-09":{"loc":33,"attributed_loc":0},"2014-10":{"loc":25,"attributed_loc":0},"2014-11":{"loc":54,"attributed_loc":0},"2014-12":{"loc":22,"attributed_loc":0},"2015-01":{"loc":81,"attributed_loc":0},"2015-02":{"loc":505,"attributed_loc":0},"2015-03":{"loc":31,"attributed_loc":0},"2015-04":{"loc":0,"attributed_loc":0},"2015-06":{"loc":0,"attributed_loc":0},"2015-07":{"loc":59,"attributed_loc":0},"2015-08":{"loc":0,"attributed_loc":0},"2015-09":{"loc":3,"attributed_loc":0},"2015-10":{"loc":0,"attributed_loc":0},"2015-11":{"loc":0,"attributed_loc":0},"2016-01":{"loc":0,"attributed_loc":0},"2016-05":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":378.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":11614.0,"pre_ai_era_burst_loc":0.0,"measured_loc":11614.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":170.2574881765633,"median_loc_per_hour":37.00945059249828,"pr_timed_units":0.0,"excluded_import_loc":19029.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["82ba7f8a727cf84a184def77c7f7dbebbd3fc1c6"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2548.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 82ba7f8a72); removed from the current tree but still retrievable","path":"spec/dummy/config/initializers/secret_token.rb","line":7,"fingerprint":"82ba7f8a727cf84a184def77c7f7dbebbd3fc1c6:spec/dummy/config/initializers/secret_token.rb:generic-api-key:7"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":33.0,"findings_high":0.0,"findings_medium":33.0,"findings_low":0.0,"weighted_findings":11.75,"scanned_lines":2548.0,"parse_errors":19.0},"findings":[{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/admin/categories_controller.rb","line":42,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/admin/categories_controller.rb:42"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/admin/forums_controller.rb","line":43,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/admin/forums_controller.rb:43"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-redirect","severity":"medium","message":"When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium]","path":"app/controllers/forem/admin/groups_controller.rb","line":18,"fingerprint":"ruby.rails.security.audit.xss.avoid-redirect:app/controllers/forem/admin/groups_controller.rb:18"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/admin/groups_controller.rb","line":34,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/admin/groups_controller.rb:34"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/admin/members_controller.rb","line":26,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/admin/members_controller.rb:26"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/admin/topics_controller.rb","line":48,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/admin/topics_controller.rb:48"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/moderation_controller.rb","line":32,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/moderation_controller.rb:32"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/posts_controller.rb","line":117,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/posts_controller.rb:117"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"app/controllers/forem/topics_controller.rb","line":98,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:app/controllers/forem/topics_controller.rb:98"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-content-tag","severity":"medium","message":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low]","path":"app/helpers/forem/application_helper.rb","line":21,"fingerprint":"ruby.rails.security.audit.xss.avoid-content-tag:app/helpers/forem/application_helper.rb:21"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/forem/application_helper.rb","line":22,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/forem/application_helper.rb:22"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/forem/application_helper.rb","line":44,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/forem/application_helper.rb:44"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/forem/formatting_helper.rb","line":8,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/forem/formatting_helper.rb:8"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/forem/formatting_helper.rb","line":14,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/forem/formatting_helper.rb:14"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"app/helpers/forem/formatting_helper.rb","line":16,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:app/helpers/forem/formatting_helper.rb:16"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"app/helpers/forem/posts_helper.rb","line":16,"fingerprint":"ruby.lang.security.weak-hashes-md5:app/helpers/forem/posts_helper.rb:16"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-content-tag","severity":"medium","message":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low]","path":"app/helpers/forem/topics_helper.rb","line":16,"fingerprint":"ruby.rails.security.audit.xss.avoid-content-tag:app/helpers/forem/topics_helper.rb:16"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-content-tag","severity":"medium","message":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low]","path":"app/helpers/forem/topics_helper.rb","line":34,"fingerprint":"ruby.rails.security.audit.xss.avoid-content-tag:app/helpers/forem/topics_helper.rb:34"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/forem/admin/categories/index.html.erb","line":16,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/forem/admin/categories/index.html.erb:16"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/forem/admin/forums/index.html.erb","line":21,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/forem/admin/forums/index.html.erb:21"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/admin/groups/show.html.erb","line":21,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/admin/groups/show.html.erb:21"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/categories/show.html.erb","line":2,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/categories/show.html.erb:2"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/forem/forums/_forum.html.erb","line":2,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/forem/forums/_forum.html.erb:2"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/_topic.html.erb","line":20,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/_topic.html.erb:20"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"app/views/forem/topics/show.html.erb","line":1,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:app/views/forem/topics/show.html.erb:1"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":7,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:7"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":10,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:10"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":14,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:14"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":16,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:16"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":22,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:22"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":23,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:23"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":24,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:24"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"app/views/forem/topics/show.html.erb","line":25,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:app/views/forem/topics/show.html.erb:25"}],"evidence":[],"data":{"rulesets":["ruby"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"Gemfile has no lockfile alongside it (unpinned dependencies)","ref":"Gemfile","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":264.0,"function_nloc":1356.0,"mean_ccn":1.46,"p90_ccn":2.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1556.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":96.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":0.5,"scanned_lines":2548.0,"category:performance":2.0},"findings":[{"rule_id":"opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial","severity":"low","message":"The :reply_to_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance.","path":"db/migrate/20110228084940_add_reply_to_to_forem_posts.rb","line":3,"fingerprint":"ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial:db/migrate/20110228084940_add_reply_to_to_forem_posts.rb:3"},{"rule_id":"opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial","severity":"low","message":"The :category_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance.","path":"db/migrate/20111103214432_add_category_id_to_forums.rb","line":3,"fingerprint":"ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial:db/migrate/20111103214432_add_category_id_to_forums.rb:3"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":3561.0,"source_lines":2548.0,"test_ratio":1.3976,"ci_files":1.0,"cochange_share":0.3208,"cochange_commits":106.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (bundle exec rspec, rspec)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["bundle exec rspec","rspec"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":181.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}