{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.535888Z","repo":{"ref":{"host":"github.com","owner":"samuelcolvin","name":"spread"},"default_branch":"main","clone_url":"https://github.com/samuelcolvin/spread.git","html_url":"https://github.com/samuelcolvin/spread","description":"Spreadsheet viewer, in Rust using GPUI","stars":97,"forks":10,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":748,"primary_language":"Rust","license_spdx":"MIT","created_at":"2026-05-11T20:00:56Z","pushed_at":"2026-06-05T08:40:09Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-04-02T17:24:42Z","owner_type":"User","release_assets":[]}},"commit_sha":"180cfaccbcc0304233cfb6e8417c5c82641df59b","profile":{"lines_by_language":{"Rust":11357,"Python":243,"Shell":63},"files_by_category":{"source":10,"config":5,"binary":5,"docs":4,"other":3,"generated":1},"source_lines":11663,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.52,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":2.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":59.9,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":61.6,"duplication":59.0,"lint":100.0,"testing":45.0,"docs":65.0,"type_safety":0.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, CI runs tests; 16% of function code in complex or long functions; 9% duplicated lines. Weakest area: type safety."},"security":{"score":70.3,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":97.0,"dependencies":9.4,"ci_actions":100.0,"posture":20.0,"scorecard":null},"summary":"Security posture is adequate: 64 known vulnerabilities in 35 dependencies. Weakest area: dependencies."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":15.0,"checked":15.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":46.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":13586.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-05":{"loc":12508,"attributed_loc":0},"2026-06":{"loc":1078,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1778348515.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1778348515},{"tool":"generic-agent","path":"AGENTS.md","added_at":1778348515}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":21.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":11496.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":359.1453882230328,"median_loc_per_hour":131.5107235446618,"pr_timed_units":0.0,"excluded_import_loc":2090.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["904637c143c09efa1346f39758914dcfa13bb403"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":11663.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":4.0,"weighted_findings":1.0,"scanned_lines":11663.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/main.rs","line":295,"fingerprint":"rust.lang.security.unsafe-usage:src/main.rs:295"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"src/sources/csv.rs","line":451,"fingerprint":"rust.lang.security.temp-dir:src/sources/csv.rs:451"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/view.rs","line":4206,"fingerprint":"rust.lang.security.unsafe-usage:src/view.rs:4206"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"src/workbook.rs","line":3457,"fingerprint":"rust.lang.security.temp-dir:src/workbook.rs:3457"}],"evidence":[],"data":{"rulesets":["rust","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":35.0,"vulnerabilities":64.0,"vulns_critical":2.0,"vulns_high":12.0,"vulns_medium":4.0,"vulns_low":2.0,"vulns_unknown":44.0,"penalty":142.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0369","severity":"critical","message":"zip@7.2.0 (crates.io) is affected by RUSTSEC-2026-0369","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):RUSTSEC-2026-0369"},{"rule_id":"osv/GHSA-m665-v7pm-7grj","severity":"critical","message":"zip@7.2.0 (crates.io) is affected by GHSA-m665-v7pm-7grj","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):GHSA-m665-v7pm-7grj"},{"rule_id":"osv/RUSTSEC-2026-0436","severity":"high","message":"calamine@0.34.0 (crates.io) is affected by RUSTSEC-2026-0436","path":"Cargo.lock","line":null,"fingerprint":"calamine@0.34.0 (crates.io):RUSTSEC-2026-0436"},{"rule_id":"osv/RUSTSEC-2026-0194","severity":"high","message":"quick-xml@0.30.0 (crates.io) is affected by RUSTSEC-2026-0194","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.30.0 (crates.io):RUSTSEC-2026-0194"},{"rule_id":"osv/RUSTSEC-2026-0195","severity":"high","message":"quick-xml@0.30.0 (crates.io) is affected by RUSTSEC-2026-0195","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.30.0 (crates.io):RUSTSEC-2026-0195"},{"rule_id":"osv/RUSTSEC-2026-0194","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0194","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0194"},{"rule_id":"osv/RUSTSEC-2026-0195","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0195","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0195"},{"rule_id":"osv/GHSA-4w2j-m93h-cj5j","severity":"high","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0185, GHSA-4w2j-m93h-cj5j","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):GHSA-4w2j-m93h-cj5j"},{"rule_id":"osv/RUSTSEC-2026-0340","severity":"high","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0340","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0340"},{"rule_id":"osv/GHSA-2f9f-gq7v-9h6m","severity":"high","message":"thrift@0.17.0 (crates.io) is affected by RUSTSEC-2026-0435, GHSA-2f9f-gq7v-9h6m","path":"Cargo.lock","line":null,"fingerprint":"thrift@0.17.0 (crates.io):GHSA-2f9f-gq7v-9h6m"},{"rule_id":"osv/RUSTSEC-2026-0367","severity":"high","message":"zip@7.2.0 (crates.io) is affected by RUSTSEC-2026-0367","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):RUSTSEC-2026-0367"},{"rule_id":"osv/GHSA-q7v9-x93c-xqv3","severity":"high","message":"zip@7.2.0 (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):GHSA-q7v9-x93c-xqv3"},{"rule_id":"osv/GHSA-9hj8-73fh-9963","severity":"high","message":"zip@7.2.0 (crates.io) is affected by GHSA-9hj8-73fh-9963","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):GHSA-9hj8-73fh-9963"},{"rule_id":"osv/GHSA-hjqx-j4rw-g7xv","severity":"high","message":"zip@7.2.0 (crates.io) is affected by GHSA-hjqx-j4rw-g7xv","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):GHSA-hjqx-j4rw-g7xv"},{"rule_id":"osv/RUSTSEC-2026-0190","severity":"medium","message":"anyhow@1.0.102 (crates.io) is affected by RUSTSEC-2026-0190","path":"Cargo.lock","line":null,"fingerprint":"anyhow@1.0.102 (crates.io):RUSTSEC-2026-0190"},{"rule_id":"osv/RUSTSEC-2026-0442","severity":"medium","message":"arrow-data@56.2.0 (crates.io) is affected by RUSTSEC-2026-0442","path":"Cargo.lock","line":null,"fingerprint":"arrow-data@56.2.0 (crates.io):RUSTSEC-2026-0442"},{"rule_id":"osv/RUSTSEC-2025-0052","severity":"medium","message":"async-std@1.13.2 (crates.io) is affected by RUSTSEC-2025-0052","path":"Cargo.lock","line":null,"fingerprint":"async-std@1.13.2 (crates.io):RUSTSEC-2025-0052"},{"rule_id":"osv/RUSTSEC-2026-0204","severity":"medium","message":"crossbeam-epoch@0.9.18 (crates.io) is affected by RUSTSEC-2026-0204","path":"Cargo.lock","line":null,"fingerprint":"crossbeam-epoch@0.9.18 (crates.io):RUSTSEC-2026-0204"},{"rule_id":"osv/RUSTSEC-2026-0221","severity":"medium","message":"event-listener@5.4.1 (crates.io) is affected by RUSTSEC-2026-0221","path":"Cargo.lock","line":null,"fingerprint":"event-listener@5.4.1 (crates.io):RUSTSEC-2026-0221"},{"rule_id":"osv/GHSA-38c5-483c-4qqp","severity":"medium","message":"grid@0.18.0 (crates.io) is affected by GHSA-38c5-483c-4qqp","path":"Cargo.lock","line":null,"fingerprint":"grid@0.18.0 (crates.io):GHSA-38c5-483c-4qqp"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.4.14 (crates.io) is affected by RUSTSEC-2026-0258","path":"Cargo.lock","line":null,"fingerprint":"h2@0.4.14 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2024-0384","severity":"medium","message":"instant@0.1.13 (crates.io) is affected by RUSTSEC-2024-0384","path":"Cargo.lock","line":null,"fingerprint":"instant@0.1.13 (crates.io):RUSTSEC-2024-0384"},{"rule_id":"osv/RUSTSEC-2026-0186","severity":"medium","message":"memmap2@0.9.10 (crates.io) is affected by RUSTSEC-2026-0186","path":"Cargo.lock","line":null,"fingerprint":"memmap2@0.9.10 (crates.io):RUSTSEC-2026-0186"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0441","severity":"medium","message":"pin-utils@0.1.0 (crates.io) is affected by RUSTSEC-2026-0441","path":"Cargo.lock","line":null,"fingerprint":"pin-utils@0.1.0 (crates.io):RUSTSEC-2026-0441"},{"rule_id":"osv/RUSTSEC-2026-0173","severity":"medium","message":"proc-macro-error2@2.0.1 (crates.io) is affected by RUSTSEC-2026-0173","path":"Cargo.lock","line":null,"fingerprint":"proc-macro-error2@2.0.1 (crates.io):RUSTSEC-2026-0173"},{"rule_id":"osv/RUSTSEC-2026-0338","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0338","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0338"},{"rule_id":"osv/RUSTSEC-2026-0339","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0339","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0339"},{"rule_id":"osv/RUSTSEC-2026-0342","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0342","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0342"},{"rule_id":"osv/RUSTSEC-2026-0523","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0523","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0523"},{"rule_id":"osv/RUSTSEC-2026-0524","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0524","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0524"},{"rule_id":"osv/RUSTSEC-2026-0538","severity":"medium","message":"quinn-udp@0.5.14 (crates.io) is affected by RUSTSEC-2026-0538","path":"Cargo.lock","line":null,"fingerprint":"quinn-udp@0.5.14 (crates.io):RUSTSEC-2026-0538"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2025-0134","severity":"medium","message":"rustls-pemfile@2.2.0 (crates.io) is affected by RUSTSEC-2025-0134","path":"Cargo.lock","line":null,"fingerprint":"rustls-pemfile@2.2.0 (crates.io):RUSTSEC-2025-0134"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.13 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.13 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0206","severity":"medium","message":"rustybuzz@0.14.1 (crates.io) is affected by RUSTSEC-2026-0206","path":"Cargo.lock","line":null,"fingerprint":"rustybuzz@0.14.1 (crates.io):RUSTSEC-2026-0206"},{"rule_id":"osv/RUSTSEC-2026-0206","severity":"medium","message":"rustybuzz@0.20.1 (crates.io) is affected by RUSTSEC-2026-0206","path":"Cargo.lock","line":null,"fingerprint":"rustybuzz@0.20.1 (crates.io):RUSTSEC-2026-0206"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.52.3 (crates.io) is affected by RUSTSEC-2026-0386","path":"Cargo.lock","line":null,"fingerprint":"tokio@1.52.3 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0192","severity":"medium","message":"ttf-parser@0.20.0 (crates.io) is affected by RUSTSEC-2026-0192","path":"Cargo.lock","line":null,"fingerprint":"ttf-parser@0.20.0 (crates.io):RUSTSEC-2026-0192"},{"rule_id":"osv/RUSTSEC-2026-0192","severity":"medium","message":"ttf-parser@0.21.1 (crates.io) is affected by RUSTSEC-2026-0192","path":"Cargo.lock","line":null,"fingerprint":"ttf-parser@0.21.1 (crates.io):RUSTSEC-2026-0192"},{"rule_id":"osv/RUSTSEC-2026-0192","severity":"medium","message":"ttf-parser@0.25.1 (crates.io) is affected by RUSTSEC-2026-0192","path":"Cargo.lock","line":null,"fingerprint":"ttf-parser@0.25.1 (crates.io):RUSTSEC-2026-0192"},{"rule_id":"osv/RUSTSEC-2026-0371","severity":"medium","message":"zbus_names@4.3.2 (crates.io) is affected by RUSTSEC-2026-0371","path":"Cargo.lock","line":null,"fingerprint":"zbus_names@4.3.2 (crates.io):RUSTSEC-2026-0371"},{"rule_id":"osv/RUSTSEC-2026-0368","severity":"medium","message":"zip@7.2.0 (crates.io) is affected by RUSTSEC-2026-0368","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):RUSTSEC-2026-0368"},{"rule_id":"osv/GHSA-8hxf-qr8p-62x4","severity":"medium","message":"zip@7.2.0 (crates.io) is affected by GHSA-8hxf-qr8p-62x4","path":"Cargo.lock","line":null,"fingerprint":"zip@7.2.0 (crates.io):GHSA-8hxf-qr8p-62x4"},{"rule_id":"osv/RUSTSEC-2026-0391","severity":"medium","message":"zstd@0.13.3 (crates.io) is affected by RUSTSEC-2026-0391","path":"Cargo.lock","line":null,"fingerprint":"zstd@0.13.3 (crates.io):RUSTSEC-2026-0391"},{"rule_id":"osv/RUSTSEC-2026-0395","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0395","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0395"},{"rule_id":"osv/RUSTSEC-2026-0396","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0396","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0396"},{"rule_id":"osv/RUSTSEC-2026-0397","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0397","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0397"},{"rule_id":"osv/RUSTSEC-2026-0398","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0398","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0398"},{"rule_id":"osv/RUSTSEC-2026-0399","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0399","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0399"},{"rule_id":"osv/RUSTSEC-2026-0400","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0400","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0400"},{"rule_id":"osv/RUSTSEC-2026-0401","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0401","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0401"},{"rule_id":"osv/RUSTSEC-2026-0402","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0402","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0402"},{"rule_id":"osv/RUSTSEC-2026-0403","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0403","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0403"},{"rule_id":"osv/RUSTSEC-2026-0404","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0404","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0404"},{"rule_id":"osv/RUSTSEC-2026-0405","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0405","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0405"},{"rule_id":"osv/RUSTSEC-2026-0406","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0406","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0406"},{"rule_id":"osv/RUSTSEC-2026-0410","severity":"medium","message":"zstd-sys@2.0.16+zstd.1.5.7 (crates.io) is affected by RUSTSEC-2026-0410","path":"Cargo.lock","line":null,"fingerprint":"zstd-sys@2.0.16+zstd.1.5.7 (crates.io):RUSTSEC-2026-0410"},{"rule_id":"osv/RUSTSEC-2026-0370","severity":"medium","message":"zvariant@5.11.0 (crates.io) is affected by RUSTSEC-2026-0370","path":"Cargo.lock","line":null,"fingerprint":"zvariant@5.11.0 (crates.io):RUSTSEC-2026-0370"},{"rule_id":"osv/RUSTSEC-2026-0372","severity":"medium","message":"zvariant_derive@5.11.0 (crates.io) is affected by RUSTSEC-2026-0372","path":"Cargo.lock","line":null,"fingerprint":"zvariant_derive@5.11.0 (crates.io):RUSTSEC-2026-0372"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-w44r-93j7-qv28"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":1.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":543.0,"function_nloc":9300.0,"mean_ccn":3.2,"p90_ccn":7.0,"complex_functions":9.0,"long_functions":7.0,"many_param_functions":9.0,"risky_nloc_share":0.1616},"findings":[],"evidence":[{"kind":"complex-function","description":"read_styles in src/sources/xlsx.rs: complexity 97, 180 lines","ref":"src/sources/xlsx.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/sources/xlsx.rs#L226","weight":1.0},{"kind":"complex-function","description":"read_sheet_metadata in src/sources/xlsx.rs: complexity 41, 90 lines","ref":"src/sources/xlsx.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/sources/xlsx.rs#L600","weight":0.6833333333333333},{"kind":"complex-function","description":"run in src/main.rs: complexity 39, 208 lines","ref":"src/main.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/main.rs#L58","weight":0.65},{"kind":"complex-function","description":"parse_date_section in src/workbook.rs: complexity 30, 112 lines","ref":"src/workbook.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/workbook.rs#L1791","weight":0.5},{"kind":"complex-function","description":"render_date_field in src/workbook.rs: complexity 25, 38 lines","ref":"src/workbook.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/workbook.rs#L2405","weight":0.4166666666666667},{"kind":"complex-function","description":"cell in src/view.rs: complexity 19, 94 lines","ref":"src/view.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/view.rs#L3974","weight":0.31666666666666665},{"kind":"complex-function","description":"parse_suffix in src/workbook.rs: complexity 18, 60 lines","ref":"src/workbook.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/workbook.rs#L2132","weight":0.3},{"kind":"complex-function","description":"search_input_key_down in src/view.rs: complexity 16, 66 lines","ref":"src/view.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/view.rs#L2643","weight":0.26666666666666666},{"kind":"complex-function","description":"classify_section in src/workbook.rs: complexity 16, 46 lines","ref":"src/workbook.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/workbook.rs#L1728","weight":0.26666666666666666},{"kind":"complex-function","description":"render in src/view.rs: complexity 11, 214 lines","ref":"src/view.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/view.rs#L1545","weight":0.18333333333333332}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":8468.0,"duplicated_lines":744.0,"duplicated_share":0.0879,"files":10.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/main.rs:173 and src/main.rs:370","ref":"src/main.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/main.rs#L173","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/main.rs:905 and src/workbook.rs:930","ref":"src/main.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/main.rs#L905","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/sources/csv.rs:147 and src/sources/parquet.rs:216","ref":"src/sources/csv.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/sources/csv.rs#L147","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/sources/xlsx.rs:373 and src/sources/xlsx.rs:383","ref":"src/sources/xlsx.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/sources/xlsx.rs#L373","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/view.rs:1134 and src/view.rs:1161","ref":"src/view.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/view.rs#L1134","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/view.rs:4354 and src/workbook.rs:2485","ref":"src/view.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/view.rs#L4354","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/workbook.rs:305 and src/workbook.rs:324","ref":"src/workbook.rs","url":"https://github.com/samuelcolvin/spread/blob/180cfaccbcc0304233cfb6e8417c5c82641df59b/src/workbook.rs#L305","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":11663.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":11663.0,"test_ratio":0.0,"ci_files":1.0,"cochange_share":0.0,"cochange_commits":38.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (make test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (clippy, rustfmt)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["make test"],"lint_commands":["clippy","rustfmt"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":66.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":7.0,"escapes_per_kloc":7.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}