{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.567554Z","repo":{"ref":{"host":"github.com","owner":"senchalabs","name":"jsduck"},"default_branch":"master","clone_url":"https://github.com/senchalabs/jsduck.git","html_url":"https://github.com/senchalabs/jsduck","description":"Simple JavaScript Duckumentation generator.","stars":1488,"forks":234,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":6202,"primary_language":"Ruby","license_spdx":"GPL-3.0","created_at":"2010-10-04T13:40:38Z","pushed_at":"2020-04-16T21:37:08Z","security_policy_url":null,"distribution":{"owner_created_at":"2010-06-24T17:28:40Z","owner_type":"Organization","release_assets":[{"name":"jsduck-6.0.0-beta.exe","size":3363595,"download_count":8218,"release_tag":"v6.0.0.beta","url":"https://github.com/senchalabs/jsduck/releases/download/v6.0.0.beta/jsduck-6.0.0-beta.exe"},{"name":"jsduck-5.3.4.exe","size":3148972,"download_count":7116,"release_tag":"v5.3.4","url":"https://github.com/senchalabs/jsduck/releases/download/v5.3.4/jsduck-5.3.4.exe"},{"name":"jsduck-5.3.2.exe","size":3151151,"download_count":232,"release_tag":"v5.3.2","url":"https://github.com/senchalabs/jsduck/releases/download/v5.3.2/jsduck-5.3.2.exe"},{"name":"jsduck-5.3.0.exe","size":3149087,"download_count":161,"release_tag":"v5.3.0","url":"https://github.com/senchalabs/jsduck/releases/download/v5.3.0/jsduck-5.3.0.exe"},{"name":"jsduck-5.2.0.exe","size":3147870,"download_count":105,"release_tag":"v5.2.0","url":"https://github.com/senchalabs/jsduck/releases/download/v5.2.0/jsduck-5.2.0.exe"},{"name":"jsduck-5.1.0.exe","size":3138907,"download_count":109,"release_tag":"v5.1.0","url":"https://github.com/senchalabs/jsduck/releases/download/v5.1.0/jsduck-5.1.0.exe"},{"name":"jsduck-5.0.1.exe","size":3141082,"download_count":104,"release_tag":"v5.0.1","url":"https://github.com/senchalabs/jsduck/releases/download/v5.0.1/jsduck-5.0.1.exe"},{"name":"jsduck-5.0.0.exe","size":3133544,"download_count":152,"release_tag":"v5.0.0","url":"https://github.com/senchalabs/jsduck/releases/download/v5.0.0/jsduck-5.0.0.exe"}]}},"commit_sha":"febef5558ecd05da25f5c260365acc3afd0cafd8","profile":{"lines_by_language":{"Ruby":28577,"JavaScript":16571,"PHP":95},"files_by_category":{"source":321,"test":85,"binary":56,"other":38,"docs":3,"config":2,"vendored":1},"source_lines":31871,"test_lines":13372},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":70.4,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":73.0,"duplication":92.9,"lint":99.2,"testing":66.0,"docs":65.0,"type_safety":null,"process":5.0},"summary":"Code quality is adequate: test-to-source ratio 0.42, no CI test run detected; 10% of function code in complex or long functions; 1% duplicated lines. Weakest area: process."},"security":{"score":70.4,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":93.7,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":20.0},"summary":"Security posture is adequate: 4 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":1.9,"check:Code-Review":1.0,"check:Maintained":0.0,"check:Binary-Artifacts":10.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:Fuzzing":0.0,"check:License":10.0,"check:Branch-Protection":0.0,"check:Signed-Releases":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 1/10 (Found 5/29 approved changesets -- score normalized to 1)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":0.9},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Signed-Releases: 0/10 (Project has not signed or included provenance with any releases.)","ref":"Signed-Releases","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/senchalabs/jsduck","weight":1.0}],"data":{"date":"2026-10-19","commit":"febef5558ecd05da25f5c260365acc3afd0cafd8","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":3277.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":208819.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2010-10":{"loc":2615,"attributed_loc":0},"2010-11":{"loc":1705,"attributed_loc":0},"2010-12":{"loc":4121,"attributed_loc":0},"2011-01":{"loc":682,"attributed_loc":0},"2011-02":{"loc":274,"attributed_loc":0},"2011-03":{"loc":1084,"attributed_loc":0},"2011-04":{"loc":847,"attributed_loc":0},"2011-05":{"loc":94579,"attributed_loc":0},"2011-06":{"loc":4683,"attributed_loc":0},"2011-07":{"loc":3535,"attributed_loc":0},"2011-08":{"loc":7764,"attributed_loc":0},"2011-09":{"loc":8467,"attributed_loc":0},"2011-10":{"loc":3869,"attributed_loc":0},"2011-11":{"loc":3517,"attributed_loc":0},"2011-12":{"loc":1164,"attributed_loc":0},"2012-01":{"loc":1340,"attributed_loc":0},"2012-02":{"loc":2408,"attributed_loc":0},"2012-03":{"loc":3110,"attributed_loc":0},"2012-04":{"loc":4007,"attributed_loc":0},"2012-05":{"loc":4397,"attributed_loc":0},"2012-06":{"loc":471,"attributed_loc":0},"2012-07":{"loc":1395,"attributed_loc":0},"2012-08":{"loc":10032,"attributed_loc":0},"2012-09":{"loc":7668,"attributed_loc":0},"2012-10":{"loc":3127,"attributed_loc":0},"2012-11":{"loc":1141,"attributed_loc":0},"2012-12":{"loc":1999,"attributed_loc":0},"2013-01":{"loc":11641,"attributed_loc":0},"2013-02":{"loc":1182,"attributed_loc":0},"2013-03":{"loc":1193,"attributed_loc":0},"2013-04":{"loc":1440,"attributed_loc":0},"2013-05":{"loc":2214,"attributed_loc":0},"2013-06":{"loc":776,"attributed_loc":0},"2013-07":{"loc":807,"attributed_loc":0},"2013-08":{"loc":2055,"attributed_loc":0},"2013-09":{"loc":576,"attributed_loc":0},"2013-10":{"loc":460,"attributed_loc":0},"2013-11":{"loc":6329,"attributed_loc":0},"2013-12":{"loc":29,"attributed_loc":0},"2014-03":{"loc":67,"attributed_loc":0},"2014-05":{"loc":0,"attributed_loc":0},"2014-10":{"loc":2,"attributed_loc":0},"2014-11":{"loc":27,"attributed_loc":0},"2015-04":{"loc":0,"attributed_loc":0},"2015-05":{"loc":3,"attributed_loc":0},"2015-06":{"loc":17,"attributed_loc":0},"2016-01":{"loc":0,"attributed_loc":0},"2018-09":{"loc":0,"attributed_loc":0},"2019-01":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":1344.0,"flagged_units":0.0,"pre_ai_era_bursts":7.0,"pre_ai_era_measured_loc":208819.0,"pre_ai_era_burst_loc":103121.0,"measured_loc":208819.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":22298.75,"median_loc_per_hour":55.74317559901222,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":78.0,"flagged_releases":0.0,"max_loc_per_day":16707.9},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1","to":"v0.2","loc":351,"days":13.81,"loc_per_day":25.4,"flagged":false},{"from":"v0.2","to":"v0.3","loc":331,"days":29.14,"loc_per_day":11.4,"flagged":false},{"from":"v0.3","to":"v0.4","loc":274,"days":20.02,"loc_per_day":13.7,"flagged":false},{"from":"v0.4","to":"v0.5","loc":770,"days":28.95,"loc_per_day":26.6,"flagged":false},{"from":"v0.5","to":"v0.6","loc":1161,"days":29.14,"loc_per_day":39.8,"flagged":false},{"from":"v0.6","to":"v3.0.pre","loc":110680,"days":133.74,"loc_per_day":827.6,"flagged":false},{"from":"v3.0.pre","to":"v3.0.pre2","loc":6848,"days":11.94,"loc_per_day":573.7,"flagged":false},{"from":"v3.0.pre2","to":"v3.0.pre3","loc":2141,"days":27.04,"loc_per_day":79.2,"flagged":false},{"from":"v3.0.pre3","to":"v3.0","loc":156,"days":3.84,"loc_per_day":40.7,"flagged":false},{"from":"v3.0","to":"v3.0.1","loc":1,"days":1.0,"loc_per_day":1.0,"flagged":false},{"from":"v3.0.1","to":"v3.1.0","loc":5569,"days":25.04,"loc_per_day":222.4,"flagged":false},{"from":"v3.1.0","to":"v3.2.1","loc":1677,"days":21.18,"loc_per_day":79.2,"flagged":false},{"from":"v3.2.1","to":"v3.3.0","loc":507,"days":27.95,"loc_per_day":18.1,"flagged":false},{"from":"v3.3.0","to":"v3.3.1","loc":153,"days":15.13,"loc_per_day":10.1,"flagged":false},{"from":"v3.3.1","to":"v3.4.0","loc":527,"days":11.21,"loc_per_day":47.0,"flagged":false},{"from":"v3.4.0","to":"v3.4.1","loc":17,"days":0.04,"loc_per_day":408.0,"flagged":false},{"from":"v3.4.1","to":"v3.5.0","loc":812,"days":15.69,"loc_per_day":51.8,"flagged":false},{"from":"v3.5.0","to":"v3.6.0","loc":390,"days":5.01,"loc_per_day":77.8,"flagged":false},{"from":"v3.6.0","to":"v3.6.1","loc":2,"days":0.77,"loc_per_day":2.6,"flagged":false},{"from":"v3.6.1","to":"v3.7.0","loc":1280,"days":8.11,"loc_per_day":157.8,"flagged":false},{"from":"v3.7.0","to":"v3.8.0","loc":1965,"days":14.98,"loc_per_day":131.2,"flagged":false},{"from":"v3.8.0","to":"v3.8.1","loc":1,"days":0.04,"loc_per_day":24.0,"flagged":false},{"from":"v3.8.1","to":"v3.8.2","loc":268,"days":14.07,"loc_per_day":19.0,"flagged":false},{"from":"v3.8.2","to":"v3.8.3","loc":412,"days":7.03,"loc_per_day":58.6,"flagged":false},{"from":"v3.8.3","to":"v3.8.4","loc":37,"days":3.94,"loc_per_day":9.4,"flagged":false},{"from":"v3.8.4","to":"v3.9.0.pre","loc":60,"days":0.95,"loc_per_day":63.0,"flagged":false},{"from":"v3.9.0.pre","to":"v3.9.0","loc":5,"days":6.87,"loc_per_day":0.7,"flagged":false},{"from":"v3.9.0","to":"v3.9.1","loc":19,"days":8.18,"loc_per_day":2.3,"flagged":false},{"from":"v3.9.1","to":"v3.10.0","loc":1737,"days":9.04,"loc_per_day":192.1,"flagged":false},{"from":"v3.10.0","to":"v3.10.1","loc":624,"days":6.98,"loc_per_day":89.4,"flagged":false},{"from":"v3.10.1","to":"v3.10.2","loc":5,"days":3.08,"loc_per_day":1.6,"flagged":false},{"from":"v3.10.2","to":"v3.10.3","loc":2,"days":0.04,"loc_per_day":48.0,"flagged":false},{"from":"v3.10.3","to":"v3.10.4","loc":77,"days":1.83,"loc_per_day":42.0,"flagged":false},{"from":"v3.10.4","to":"v3.10.5","loc":337,"days":6.98,"loc_per_day":48.3,"flagged":false},{"from":"v3.10.5","to":"v3.11.0","loc":867,"days":12.93,"loc_per_day":67.1,"flagged":false},{"from":"v3.11.0","to":"v4.0.beta","loc":6086,"days":22.08,"loc_per_day":275.6,"flagged":false},{"from":"v4.0.beta","to":"v3.11.1","loc":17,"days":29.01,"loc_per_day":0.6,"flagged":false},{"from":"v3.11.1","to":"v4.0.beta2","loc":7442,"days":5.96,"loc_per_day":1249.4,"flagged":false},{"from":"v4.0.beta2","to":"v3.11.2","loc":52,"days":5.91,"loc_per_day":8.8,"flagged":false},{"from":"v3.11.2","to":"v4.0.0","loc":12119,"days":2.18,"loc_per_day":5558.6,"flagged":false},{"from":"v4.0.0","to":"v4.0.1","loc":231,"days":12.0,"loc_per_day":19.3,"flagged":false},{"from":"v4.0.1","to":"v4.1.1","loc":9335,"days":23.94,"loc_per_day":389.9,"flagged":false},{"from":"v4.1.1","to":"v4.2.0","loc":1913,"days":17.29,"loc_per_day":110.6,"flagged":false},{"from":"v4.2.0","to":"v4.2.1","loc":37,"days":10.79,"loc_per_day":3.4,"flagged":false},{"from":"v4.2.1","to":"v4.3.0","loc":4441,"days":12.01,"loc_per_day":369.9,"flagged":false},{"from":"v4.3.0","to":"v4.3.1","loc":1,"days":0.06,"loc_per_day":16.2,"flagged":false},{"from":"v4.3.1","to":"v4.3.2","loc":111,"days":1.88,"loc_per_day":59.0,"flagged":false},{"from":"v4.3.2","to":"v4.4.0","loc":485,"days":17.33,"loc_per_day":28.0,"flagged":false},{"from":"v4.4.0","to":"v4.4.1","loc":71,"days":7.55,"loc_per_day":9.4,"flagged":false},{"from":"v4.4.1","to":"v4.5.0","loc":689,"days":16.37,"loc_per_day":42.1,"flagged":false},{"from":"v4.5.0","to":"v4.5.1","loc":118,"days":1.15,"loc_per_day":102.5,"flagged":false},{"from":"v4.5.1","to":"v4.6.0","loc":298,"days":32.43,"loc_per_day":9.2,"flagged":false},{"from":"v4.6.0","to":"v4.6.1","loc":1302,"days":8.23,"loc_per_day":158.3,"flagged":false},{"from":"v4.6.1","to":"v4.6.2","loc":1025,"days":39.1,"loc_per_day":26.2,"flagged":false},{"from":"v4.6.2","to":"v5.0.0.beta","loc":11379,"days":0.68,"loc_per_day":16707.9,"flagged":false},{"from":"v5.0.0.beta","to":"v4.7.0","loc":108,"days":24.12,"loc_per_day":4.5,"flagged":false},{"from":"v4.7.0","to":"v4.7.1","loc":33,"days":3.14,"loc_per_day":10.5,"flagged":false},{"from":"v4.7.1","to":"v5.0.0.beta2","loc":13431,"days":8.8,"loc_per_day":1527.0,"flagged":false},{"from":"v5.0.0.beta2","to":"v4.8.0","loc":50,"days":19.38,"loc_per_day":2.6,"flagged":false},{"from":"v4.8.0","to":"v4.9.0","loc":283,"days":10.62,"loc_per_day":26.7,"flagged":false},{"from":"v4.9.0","to":"v4.10.0","loc":544,"days":6.99,"loc_per_day":77.8,"flagged":false},{"from":"v4.10.0","to":"v4.10.1","loc":40,"days":11.07,"loc_per_day":3.6,"flagged":false},{"from":"v4.10.1","to":"v4.10.2","loc":8,"days":2.84,"loc_per_day":2.8,"flagged":false},{"from":"v4.10.2","to":"v4.10.3","loc":5,"days":0.19,"loc_per_day":25.7,"flagged":false},{"from":"v4.10.3","to":"v5.0.0.beta3","loc":15717,"days":4.02,"loc_per_day":3910.9,"flagged":false},{"from":"v5.0.0.beta3","to":"v4.10.4","loc":55,"days":6.83,"loc_per_day":8.0,"flagged":false},{"from":"v4.10.4","to":"v5.0.0.beta4","loc":16895,"days":29.99,"loc_per_day":563.3,"flagged":false},{"from":"v5.0.0.beta4","to":"v5.0.0.beta5","loc":41,"days":0.27,"loc_per_day":149.9,"flagged":false},{"from":"v5.0.0.beta5","to":"v5.0.0","loc":5,"days":8.0,"loc_per_day":0.6,"flagged":false},{"from":"v5.0.0","to":"v5.0.1","loc":540,"days":20.03,"loc_per_day":27.0,"flagged":false},{"from":"v5.0.1","to":"v5.1.0","loc":26,"days":9.82,"loc_per_day":2.6,"flagged":false},{"from":"v5.1.0","to":"v5.2.0","loc":1258,"days":25.99,"loc_per_day":48.4,"flagged":false},{"from":"v5.2.0","to":"v5.3.0","loc":575,"days":20.89,"loc_per_day":27.5,"flagged":false},{"from":"v5.3.0","to":"v5.3.1","loc":11,"days":5.2,"loc_per_day":2.1,"flagged":false},{"from":"v5.3.1","to":"v5.3.2","loc":66,"days":1.78,"loc_per_day":37.0,"flagged":false},{"from":"v5.3.2","to":"v5.3.3","loc":76,"days":5.24,"loc_per_day":14.5,"flagged":false},{"from":"v5.3.3","to":"v5.3.4","loc":12,"days":6.02,"loc_per_day":2.0,"flagged":false},{"from":"v5.3.4","to":"v6.0.0.beta","loc":7224,"days":42.98,"loc_per_day":168.1,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":31871.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"findings_high":4.0,"findings_medium":9.0,"findings_low":0.0,"weighted_findings":5.95,"scanned_lines":31871.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"template/app/view/Tabs.js","line":321,"fingerprint":"javascript.browser.security.insecure-document-method:template/app/view/Tabs.js:321"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.el.dom.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"template/app/view/Tabs.js","line":321,"fingerprint":"javascript.browser.security.insecure-innerhtml:template/app/view/Tabs.js:321"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"template/resources/prettify/prettify.js","line":26,"fingerprint":"javascript.browser.security.insecure-document-method:template/resources/prettify/prettify.js:26"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"template/resources/prettify/prettify.js","line":26,"fingerprint":"javascript.browser.security.insecure-innerhtml:template/resources/prettify/prettify.js:26"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/jsduck/cache.rb","line":113,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/jsduck/cache.rb:113"},{"rule_id":"opengrep/ruby.rails.security.injection.raw-html-format","severity":"medium","message":"Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render templ [confidence medium]","path":"lib/jsduck/tag/member_tag.rb","line":126,"fingerprint":"ruby.rails.security.injection.raw-html-format:lib/jsduck/tag/member_tag.rb:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"template/app/ClassRegistry.js","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:template/app/ClassRegistry.js:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"template/app/ClassRegistry.js","line":136,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:template/app/ClassRegistry.js:136"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"template/app/ClassRegistry.js","line":137,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:template/app/ClassRegistry.js:137"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `search` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"template/app/view/cls/Overview.js","line":233,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:template/app/view/cls/Overview.js:233"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `tagname` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"template/app/view/comments/TagEditor.js","line":92,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:template/app/view/comments/TagEditor.js:92"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `endChar` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"template/resources/codemirror/markdown.js","line":171,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:template/resources/codemirror/markdown.js:171"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"template/resources/prettify/prettify.js","line":12,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:template/resources/prettify/prettify.js:12"}],"evidence":[],"data":{"rulesets":["javascript","ruby","php"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.015,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"Gemfile has no lockfile alongside it (unpinned dependencies)","ref":"Gemfile","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":8.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v6.0.0.beta ships jsduck-6.0.0-beta.exe (8218 downloads)","ref":"jsduck-6.0.0-beta.exe","url":"https://github.com/senchalabs/jsduck/releases/download/v6.0.0.beta/jsduck-6.0.0-beta.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v5.3.4 ships jsduck-5.3.4.exe (7116 downloads)","ref":"jsduck-5.3.4.exe","url":"https://github.com/senchalabs/jsduck/releases/download/v5.3.4/jsduck-5.3.4.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v5.3.2 ships jsduck-5.3.2.exe (232 downloads)","ref":"jsduck-5.3.2.exe","url":"https://github.com/senchalabs/jsduck/releases/download/v5.3.2/jsduck-5.3.2.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v5.3.0 ships jsduck-5.3.0.exe (161 downloads)","ref":"jsduck-5.3.0.exe","url":"https://github.com/senchalabs/jsduck/releases/download/v5.3.0/jsduck-5.3.0.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v5.2.0 ships jsduck-5.2.0.exe (105 downloads)","ref":"jsduck-5.2.0.exe","url":"https://github.com/senchalabs/jsduck/releases/download/v5.2.0/jsduck-5.2.0.exe","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1886.0,"function_nloc":15225.0,"mean_ccn":2.1,"p90_ccn":4.0,"complex_functions":15.0,"long_functions":4.0,"many_param_functions":0.0,"risky_nloc_share":0.1047},"findings":[],"evidence":[{"kind":"complex-function","description":"adapt_node in lib/jsduck/js/rkelly_adapter.rb: complexity 59, 352 lines","ref":"lib/jsduck/js/rkelly_adapter.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/js/rkelly_adapter.rb#L39","weight":0.9833333333333333},{"kind":"complex-function","description":"to_s in lib/jsduck/js/serializer.rb: complexity 55, 108 lines","ref":"lib/jsduck/js/serializer.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/js/serializer.rb#L8","weight":0.9166666666666666},{"kind":"complex-function","description":"g in template/resources/prettify/prettify.js: complexity 37, 3 lines","ref":"template/resources/prettify/prettify.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/template/resources/prettify/prettify.js#L27","weight":0.6166666666666667},{"kind":"complex-function","description":"init_parser in lib/jsduck/options/parser.rb: complexity 23, 775 lines","ref":"lib/jsduck/options/parser.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/options/parser.rb#L40","weight":0.38333333333333336},{"kind":"complex-function","description":"s in template/resources/prettify/prettify.js: complexity 23, 2 lines","ref":"template/resources/prettify/prettify.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/template/resources/prettify/prettify.js#L4","weight":0.38333333333333336},{"kind":"complex-function","description":"K in template/resources/prettify/prettify.js: complexity 22, 3 lines","ref":"template/resources/prettify/prettify.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/template/resources/prettify/prettify.js#L15","weight":0.36666666666666664},{"kind":"complex-function","description":"detect in lib/jsduck/js/class.rb: complexity 21, 24 lines","ref":"lib/jsduck/js/class.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/js/class.rb#L16","weight":0.35},{"kind":"complex-function","description":"detect in lib/jsduck/js/method.rb: complexity 20, 20 lines","ref":"lib/jsduck/js/method.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/js/method.rb#L16","weight":0.3333333333333333},{"kind":"complex-function","description":"(anonymous) in template/app/view/cls/Overview.js: complexity 19, 19 lines","ref":"template/app/view/cls/Overview.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/template/app/view/cls/Overview.js#L234","weight":0.31666666666666665},{"kind":"complex-function","description":"b in template/resources/prettify/prettify.js: complexity 18, 3 lines","ref":"template/resources/prettify/prettify.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/template/resources/prettify/prettify.js#L2","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":20931.0,"duplicated_lines":258.0,"duplicated_share":0.0123,"files":321.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: js-classes/Array.js:730 and js-classes/Array.js:780","ref":"js-classes/Array.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/js-classes/Array.js#L730","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: js-classes/Date.js:535 and js-classes/Date.js:687","ref":"js-classes/Date.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/js-classes/Date.js#L535","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: js-classes/Function.js:95 and js-classes/Function.js:190","ref":"js-classes/Function.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/js-classes/Function.js#L95","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: js-classes/String.js:235 and js-classes/String.js:328","ref":"js-classes/String.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/js-classes/String.js#L235","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/jsduck/class_writer.rb:18 and lib/jsduck/guide_writer.rb:18","ref":"lib/jsduck/class_writer.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/class_writer.rb#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/jsduck/inline/auto_link.rb:10 and lib/jsduck/inline/link.rb:15","ref":"lib/jsduck/inline/auto_link.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/inline/auto_link.rb#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/jsduck/inline/img.rb:24 and lib/jsduck/inline/link.rb:29","ref":"lib/jsduck/inline/img.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/inline/img.rb#L24","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/jsduck/tag/cfg.rb:52 and lib/jsduck/tag/property.rb:41","ref":"lib/jsduck/tag/cfg.rb","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/lib/jsduck/tag/cfg.rb#L52","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: template/app/controller/Failure.js:5 and template/app/controller/Welcome.js:5","ref":"template/app/controller/Failure.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/template/app/controller/Failure.js#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: template/app/view/comments/Expander.js:88 and template/app/view/comments/RepliesExpander.js:79","ref":"template/app/view/comments/Expander.js","url":"https://github.com/senchalabs/jsduck/blob/febef5558ecd05da25f5c260365acc3afd0cafd8/template/app/view/comments/Expander.js#L88","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"weighted_findings":1.0,"scanned_lines":31871.0,"category:correctness":4.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`B` is assigned twice; the first assignment is useless","path":"template/resources/prettify/prettify.js","line":8,"fingerprint":"javascript.lang.correctness.useless-assignment:template/resources/prettify/prettify.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`b` is assigned twice; the first assignment is useless","path":"template/resources/prettify/prettify.js","line":12,"fingerprint":"javascript.lang.correctness.useless-assignment:template/resources/prettify/prettify.js:12"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`c[n++]` is assigned twice; the first assignment is useless","path":"template/resources/prettify/prettify.js","line":16,"fingerprint":"javascript.lang.correctness.useless-assignment:template/resources/prettify/prettify.js:16"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`c` is assigned twice; the first assignment is useless","path":"template/resources/prettify/prettify.js","line":29,"fingerprint":"javascript.lang.correctness.useless-assignment:template/resources/prettify/prettify.js:29"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8391,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":13372.0,"source_lines":31871.0,"test_ratio":0.4196,"ci_files":1.0,"cochange_share":0.2661,"cochange_commits":233.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":118.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"COPYING","ref":"COPYING","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}