{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:54:22.905972Z","repo":{"ref":{"host":"github.com","owner":"sgoedecke","name":"deckard"},"default_branch":"main","clone_url":"https://github.com/sgoedecke/deckard.git","html_url":"https://github.com/sgoedecke/deckard","description":"Local AI-text detection for your browser.","stars":55,"forks":3,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":823,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-09-07T08:49:31Z","pushed_at":"2026-11-12T20:38:24Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-05-05T10:15:09Z","owner_type":"User","release_assets":[{"name":"deckard-v0.6.4-macos-arm64-app.tar.gz","size":3174265,"download_count":6,"release_tag":"v0.6.4","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.4/deckard-v0.6.4-macos-arm64-app.tar.gz"},{"name":"deckard-v0.6.4-macos-arm64.tar.gz","size":609738270,"download_count":19,"release_tag":"v0.6.4","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.4/deckard-v0.6.4-macos-arm64.tar.gz"},{"name":"install.sh","size":8778,"download_count":19,"release_tag":"v0.6.4","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.4/install.sh"},{"name":"SHA256SUMS","size":281,"download_count":12,"release_tag":"v0.6.4","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.4/SHA256SUMS"},{"name":"deckard-v0.6.3-macos-arm64-app.tar.gz","size":3174277,"download_count":3,"release_tag":"v0.6.3","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.3/deckard-v0.6.3-macos-arm64-app.tar.gz"},{"name":"deckard-v0.6.3-macos-arm64.tar.gz","size":609738010,"download_count":6,"release_tag":"v0.6.3","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.3/deckard-v0.6.3-macos-arm64.tar.gz"},{"name":"install.sh","size":8806,"download_count":8,"release_tag":"v0.6.3","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.3/install.sh"},{"name":"SHA256SUMS","size":281,"download_count":2,"release_tag":"v0.6.3","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.3/SHA256SUMS"},{"name":"deckard-v0.6.2-macos-arm64.tar.gz","size":609738323,"download_count":2,"release_tag":"v0.6.2","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.2/deckard-v0.6.2-macos-arm64.tar.gz"},{"name":"install.sh","size":6227,"download_count":3,"release_tag":"v0.6.2","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.2/install.sh"},{"name":"SHA256SUMS","size":177,"download_count":1,"release_tag":"v0.6.2","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.2/SHA256SUMS"},{"name":"deckard-v0.6.1-macos-arm64.tar.gz","size":609737443,"download_count":1,"release_tag":"v0.6.1","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.1/deckard-v0.6.1-macos-arm64.tar.gz"},{"name":"install.sh","size":6227,"download_count":1,"release_tag":"v0.6.1","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.1/install.sh"},{"name":"SHA256SUMS","size":177,"download_count":1,"release_tag":"v0.6.1","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.1/SHA256SUMS"},{"name":"deckard-v0.6.0-macos-arm64.tar.gz","size":609737716,"download_count":2,"release_tag":"v0.6.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.0/deckard-v0.6.0-macos-arm64.tar.gz"},{"name":"install.sh","size":6227,"download_count":5,"release_tag":"v0.6.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.0/install.sh"},{"name":"SHA256SUMS","size":177,"download_count":2,"release_tag":"v0.6.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.0/SHA256SUMS"},{"name":"deckard-v0.5.0-macos-arm64.tar.gz","size":271658760,"download_count":37,"release_tag":"v0.5.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.5.0/deckard-v0.5.0-macos-arm64.tar.gz"},{"name":"install.sh","size":5188,"download_count":39,"release_tag":"v0.5.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.5.0/install.sh"},{"name":"SHA256SUMS","size":177,"download_count":4,"release_tag":"v0.5.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.5.0/SHA256SUMS"},{"name":"deckard-v0.4.1-macos-arm64.tar.gz","size":271658436,"download_count":16,"release_tag":"v0.4.1","url":"https://github.com/sgoedecke/deckard/releases/download/v0.4.1/deckard-v0.4.1-macos-arm64.tar.gz"},{"name":"install.sh","size":5188,"download_count":21,"release_tag":"v0.4.1","url":"https://github.com/sgoedecke/deckard/releases/download/v0.4.1/install.sh"},{"name":"SHA256SUMS","size":177,"download_count":2,"release_tag":"v0.4.1","url":"https://github.com/sgoedecke/deckard/releases/download/v0.4.1/SHA256SUMS"},{"name":"deckard-v0.4.0-macos-arm64.tar.gz","size":271655542,"download_count":5,"release_tag":"v0.4.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.4.0/deckard-v0.4.0-macos-arm64.tar.gz"},{"name":"install.sh","size":5188,"download_count":5,"release_tag":"v0.4.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.4.0/install.sh"},{"name":"SHA256SUMS","size":177,"download_count":2,"release_tag":"v0.4.0","url":"https://github.com/sgoedecke/deckard/releases/download/v0.4.0/SHA256SUMS"}]}},"commit_sha":"24a0f44ed57e2daaab47f02ad0ca14662bf4c610","profile":{"lines_by_language":{"JavaScript":8033,"Python":4084,"C++":3740,"Rust":745,"Shell":598},"files_by_category":{"source":61,"test":41,"docs":12,"config":11,"other":11,"binary":6,"generated":2},"source_lines":9900,"test_lines":7300},"pillars":{"ai_provenance":{"score":99.8,"confidence":0.77,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.9981,"suspected_share":0.0,"estimated_share":0.9981,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":66.9,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":30.9,"duplication":92.7,"lint":60.7,"testing":90.0,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.74, CI runs tests; 39% of function code in complex or long functions; 1% duplicated lines. Weakest area: complexity."},"security":{"score":42.6,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":84.6,"sast":44.2,"dependencies":27.3,"ci_actions":19.4,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 39 known vulnerabilities in 9 dependencies; 18 high-severity SAST findings; 8 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":44.0,"checked":44.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":28.0,"attributed_commits":27.0,"attributed_commit_share":0.9642857142857143,"effective_loc":18160.0,"attributed_loc":18125.0,"attributed_loc_share":0.9980726872246696,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 18 attributed commits, 15,495 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 9 attributed commits, 2,630 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"24a0f44ed57e2daaab47f02ad0ca14662bf4c610","url":"https://github.com/sgoedecke/deckard/commit/24a0f44ed57e2daaab47f02ad0ca14662bf4c610","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"01fd60b142442172aefd4772705b9fcbd891803f","url":"https://github.com/sgoedecke/deckard/commit/01fd60b142442172aefd4772705b9fcbd891803f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"d0be4e1ec9aa68cf0ae9a5cd6eadb50587e95321","url":"https://github.com/sgoedecke/deckard/commit/d0be4e1ec9aa68cf0ae9a5cd6eadb50587e95321","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"84b167fef256d625d1f300d51b886b2c968690ff","url":"https://github.com/sgoedecke/deckard/commit/84b167fef256d625d1f300d51b886b2c968690ff","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"75447b45cb539b418b05120fefe76b447be7d304","url":"https://github.com/sgoedecke/deckard/commit/75447b45cb539b418b05120fefe76b447be7d304","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"a1b760899d3e4f6848e97de97b14fe3719df03fa","url":"https://github.com/sgoedecke/deckard/commit/a1b760899d3e4f6848e97de97b14fe3719df03fa","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"6798963a448397aa5b474a68be668faec8f218dc","url":"https://github.com/sgoedecke/deckard/commit/6798963a448397aa5b474a68be668faec8f218dc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bed47fd8894600da86cb971ed26c44d0ee0731b7","url":"https://github.com/sgoedecke/deckard/commit/bed47fd8894600da86cb971ed26c44d0ee0731b7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c674fcea44760252973b8a033b8856a81f310ea6","url":"https://github.com/sgoedecke/deckard/commit/c674fcea44760252973b8a033b8856a81f310ea6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"02bd181949f2c5e47137bee0a7371d17984166a4","url":"https://github.com/sgoedecke/deckard/commit/02bd181949f2c5e47137bee0a7371d17984166a4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2f3684c8200b029cf18dc7b02f7a914ae2f43564","url":"https://github.com/sgoedecke/deckard/commit/2f3684c8200b029cf18dc7b02f7a914ae2f43564","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"97e1a48155d99f6def24cc62822de94e1ca78e66","url":"https://github.com/sgoedecke/deckard/commit/97e1a48155d99f6def24cc62822de94e1ca78e66","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"0a6a6917d097c77019154304b4287eb147e836aa","url":"https://github.com/sgoedecke/deckard/commit/0a6a6917d097c77019154304b4287eb147e836aa","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"a3f97233721b05d039d697121ec09bc6be116fd5","url":"https://github.com/sgoedecke/deckard/commit/a3f97233721b05d039d697121ec09bc6be116fd5","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"fc88e9cac133a98dcf837e4331133f677983f05d","url":"https://github.com/sgoedecke/deckard/commit/fc88e9cac133a98dcf837e4331133f677983f05d","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"f835d654135433c85893dc45e45c25cddeb41548","url":"https://github.com/sgoedecke/deckard/commit/f835d654135433c85893dc45e45c25cddeb41548","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"cbedd23c066b25ebe524a96f237b4d5cc77b69b3","url":"https://github.com/sgoedecke/deckard/commit/cbedd23c066b25ebe524a96f237b4d5cc77b69b3","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"18437d5f657501ed694feef2db985f47a815caca","url":"https://github.com/sgoedecke/deckard/commit/18437d5f657501ed694feef2db985f47a815caca","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"2db0b4caf0326cf63612b4da610840dd16ce2d0e","url":"https://github.com/sgoedecke/deckard/commit/2db0b4caf0326cf63612b4da610840dd16ce2d0e","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"566038c2e7a018973b7e23d36bb3c9ce68e8fa3d","url":"https://github.com/sgoedecke/deckard/commit/566038c2e7a018973b7e23d36bb3c9ce68e8fa3d","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"38a257a03396c081a939378b488263d977bb07e8","url":"https://github.com/sgoedecke/deckard/commit/38a257a03396c081a939378b488263d977bb07e8","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"4311346592743208188e254ef2f81dca9bb43ddd","url":"https://github.com/sgoedecke/deckard/commit/4311346592743208188e254ef2f81dca9bb43ddd","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"1b72029b374173b5a74f565e3cc6c23389986afa","url":"https://github.com/sgoedecke/deckard/commit/1b72029b374173b5a74f565e3cc6c23389986afa","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"3972168f885f47d2dd1df878f2bc8dfaad87e606","url":"https://github.com/sgoedecke/deckard/commit/3972168f885f47d2dd1df878f2bc8dfaad87e606","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"671c3c6322058b3bef793e1595ba5aed4802e3bd","url":"https://github.com/sgoedecke/deckard/commit/671c3c6322058b3bef793e1595ba5aed4802e3bd","weight":0.9}],"data":{"attributed_loc_by_commit":{"d01989fb836704479770f4bbfb2db9a9ccc2bc9f":6318,"d7ce1a3098a41a72eba77e6f0fec14c1f00877c1":1816,"671c3c6322058b3bef793e1595ba5aed4802e3bd":3,"3972168f885f47d2dd1df878f2bc8dfaad87e606":23,"1b72029b374173b5a74f565e3cc6c23389986afa":0,"4311346592743208188e254ef2f81dca9bb43ddd":402,"38a257a03396c081a939378b488263d977bb07e8":0,"566038c2e7a018973b7e23d36bb3c9ce68e8fa3d":0,"2db0b4caf0326cf63612b4da610840dd16ce2d0e":0,"18437d5f657501ed694feef2db985f47a815caca":680,"cbedd23c066b25ebe524a96f237b4d5cc77b69b3":0,"f835d654135433c85893dc45e45c25cddeb41548":5299,"fc88e9cac133a98dcf837e4331133f677983f05d":384,"a3f97233721b05d039d697121ec09bc6be116fd5":175,"0a6a6917d097c77019154304b4287eb147e836aa":290,"97e1a48155d99f6def24cc62822de94e1ca78e66":51,"2f3684c8200b029cf18dc7b02f7a914ae2f43564":13,"02bd181949f2c5e47137bee0a7371d17984166a4":24,"c674fcea44760252973b8a033b8856a81f310ea6":54,"bed47fd8894600da86cb971ed26c44d0ee0731b7":854,"6798963a448397aa5b474a68be668faec8f218dc":54,"a1b760899d3e4f6848e97de97b14fe3719df03fa":0,"75447b45cb539b418b05120fefe76b447be7d304":142,"84b167fef256d625d1f300d51b886b2c968690ff":169,"d0be4e1ec9aa68cf0ae9a5cd6eadb50587e95321":1139,"01fd60b142442172aefd4772705b9fcbd891803f":74,"24a0f44ed57e2daaab47f02ad0ca14662bf4c610":161},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":18,"loc":15495,"first_seen":1788770995,"last_seen":1791518241},"claude-code":{"name":"Claude Code","commits":9,"loc":2630,"first_seen":1791336064,"last_seen":1794515904}},"monthly":{"2026-09":{"loc":15441,"attributed_loc":15441},"2026-10":{"loc":2449,"attributed_loc":2449},"2026-11":{"loc":270,"attributed_loc":235}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":14.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":6543.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":922.6890756302521,"median_loc_per_hour":100.5,"pr_timed_units":6.0,"excluded_import_loc":11617.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["d01989fb836704479770f4bbfb2db9a9ccc2bc9f","f835d654135433c85893dc45e45c25cddeb41548"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":7.0,"flagged_releases":0.0,"max_loc_per_day":6960.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.4.0","to":"v0.4.1","loc":402,"days":0.5,"loc_per_day":800.8,"flagged":false},{"from":"v0.4.1","to":"v0.5.0","loc":680,"days":0.61,"loc_per_day":1117.6,"flagged":false},{"from":"v0.5.0","to":"v0.6.0","loc":0,"days":4.82,"loc_per_day":0.0,"flagged":false},{"from":"v0.6.0","to":"v0.6.1","loc":384,"days":0.62,"loc_per_day":615.1,"flagged":false},{"from":"v0.6.1","to":"v0.6.2","loc":175,"days":0.04,"loc_per_day":4200.0,"flagged":false},{"from":"v0.6.2","to":"v0.6.3","loc":290,"days":0.04,"loc_per_day":6960.0,"flagged":false},{"from":"v0.6.3","to":"v0.6.4","loc":51,"days":2.17,"loc_per_day":23.5,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":9900.0,"index":0.051,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":1.0,"per_kloc:emoji_in_code":0.101,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":5.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"native-cli/model-assets-linux.json","line":12,"fingerprint":"native-cli/model-assets-linux.json:generic-api-key:12"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"extension/manifest.json","line":6,"fingerprint":"extension/manifest.json:generic-api-key:6"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"native-cli/model-assets.json","line":14,"fingerprint":"native-cli/model-assets.json:generic-api-key:14"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"native-cli/src/support.hpp","line":20,"fingerprint":"native-cli/src/support.hpp:generic-api-key:20"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit d7ce1a3098); removed from the current tree but still retrievable","path":"scripts/package-release.mjs","line":42,"fingerprint":"d7ce1a3098a41a72eba77e6f0fec14c1f00877c1:scripts/package-release.mjs:generic-api-key:42"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":27.0,"findings_high":18.0,"findings_medium":0.0,"findings_low":9.0,"weighted_findings":23.1,"scanned_lines":9900.0,"parse_errors":3.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/benchmark.py","line":58,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/benchmark.py:58"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/bounded.py","line":11,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/bounded.py:11"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/bounded.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/bounded.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"native-cli/coreml/bounded.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:native-cli/coreml/bounded.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/export.py","line":110,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/export.py:110"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"native-cli/coreml/export.py","line":111,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:native-cli/coreml/export.py:111"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/power_compare.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/power_compare.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"native-cli/coreml/power_compare.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:native-cli/coreml/power_compare.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/power_qos.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/power_qos.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/profile_instruments.py","line":109,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/profile_instruments.py:109"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"native-cli/coreml/profile_instruments.py","line":109,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:native-cli/coreml/profile_instruments.py:109"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/profile_instruments.py","line":128,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/profile_instruments.py:128"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"native-cli/coreml/profile_instruments.py","line":129,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:native-cli/coreml/profile_instruments.py:129"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/profile_instruments.py","line":133,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/profile_instruments.py:133"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"native-cli/coreml/profile_instruments.py","line":134,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:native-cli/coreml/profile_instruments.py:134"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"native-cli/coreml/profile_runtime.py","line":78,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:native-cli/coreml/profile_runtime.py:78"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"native-cli/coreml/report_instruments.py","line":8,"fingerprint":"python.lang.security.use-defused-xml:native-cli/coreml/report_instruments.py:8"},{"rule_id":"opengrep/python.lang.security.use-defused-xml-parse","severity":"high","message":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`. [confidence medium]","path":"native-cli/coreml/report_instruments.py","line":12,"fingerprint":"python.lang.security.use-defused-xml-parse:native-cli/coreml/report_instruments.py:12"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/candle/src/lib.rs","line":112,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/candle/src/lib.rs:112"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/candle/src/lib.rs","line":216,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/candle/src/lib.rs:216"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/candle/src/lib.rs","line":235,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/candle/src/lib.rs:235"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/candle/src/lib.rs","line":257,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/candle/src/lib.rs:257"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/tokenizer/src/lib.rs","line":313,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/tokenizer/src/lib.rs:313"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/tokenizer/src/lib.rs","line":342,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/tokenizer/src/lib.rs:342"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/tokenizer/src/lib.rs","line":382,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/tokenizer/src/lib.rs:382"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/tokenizer/src/lib.rs","line":395,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/tokenizer/src/lib.rs:395"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native-cli/tokenizer/src/lib.rs","line":434,"fingerprint":"rust.lang.security.unsafe-usage:native-cli/tokenizer/src/lib.rs:434"}],"evidence":[],"data":{"rulesets":["c","python","javascript","rust","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":9.0,"vulnerabilities":39.0,"vulns_critical":4.0,"vulns_high":13.0,"vulns_medium":16.0,"vulns_low":3.0,"vulns_unknown":3.0,"penalty":78.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0369","severity":"critical","message":"zip@8.6.0 (crates.io) is affected by RUSTSEC-2026-0369","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):RUSTSEC-2026-0369"},{"rule_id":"osv/GHSA-m665-v7pm-7grj","severity":"critical","message":"zip@8.6.0 (crates.io) is affected by GHSA-m665-v7pm-7grj","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):GHSA-m665-v7pm-7grj"},{"rule_id":"osv/GHSA-6q48-6c7w-9gw2","severity":"critical","message":"certifi@2026.7.22 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"certifi@2026.7.22 (PyPI):GHSA-6q48-6c7w-9gw2"},{"rule_id":"osv/GHSA-fgcw-684q-jj6r","severity":"critical","message":"transformers@5.2.0 (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"transformers@5.2.0 (PyPI):GHSA-fgcw-684q-jj6r"},{"rule_id":"osv/RUSTSEC-2026-0367","severity":"high","message":"zip@8.6.0 (crates.io) is affected by RUSTSEC-2026-0367","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):RUSTSEC-2026-0367"},{"rule_id":"osv/GHSA-q7v9-x93c-xqv3","severity":"high","message":"zip@8.6.0 (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):GHSA-q7v9-x93c-xqv3"},{"rule_id":"osv/GHSA-9hj8-73fh-9963","severity":"high","message":"zip@8.6.0 (crates.io) is affected by GHSA-9hj8-73fh-9963","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):GHSA-9hj8-73fh-9963"},{"rule_id":"osv/GHSA-hjqx-j4rw-g7xv","severity":"high","message":"zip@8.6.0 (crates.io) is affected by GHSA-hjqx-j4rw-g7xv","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):GHSA-hjqx-j4rw-g7xv"},{"rule_id":"osv/PYSEC-2025-203","severity":"high","message":"torch@2.8.0 (PyPI) is affected by PYSEC-2025-203","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):PYSEC-2025-203"},{"rule_id":"osv/PYSEC-2025-204","severity":"high","message":"torch@2.8.0 (PyPI) is affected by PYSEC-2025-204","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):PYSEC-2025-204"},{"rule_id":"osv/PYSEC-2026-139","severity":"high","message":"torch@2.8.0 (PyPI) is affected by PYSEC-2026-139","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):PYSEC-2026-139"},{"rule_id":"osv/GHSA-63cw-57p8-fm3p","severity":"high","message":"torch@2.8.0 (PyPI) is affected by PYSEC-2026-2286, GHSA-63cw-57p8-fm3p","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):GHSA-63cw-57p8-fm3p"},{"rule_id":"osv/GHSA-v4x8-3wr5-3wq8","severity":"high","message":"filelock@3.32.3 (PyPI) is affected by GHSA-v4x8-3wr5-3wq8","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-v4x8-3wr5-3wq8"},{"rule_id":"osv/GHSA-5rjg-fvgr-3xxf","severity":"high","message":"setuptools@78.1.0 (PyPI) is affected by PYSEC-2025-49, GHSA-5rjg-fvgr-3xxf","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"setuptools@78.1.0 (PyPI):GHSA-5rjg-fvgr-3xxf"},{"rule_id":"osv/GHSA-29pf-2h5f-8g72","severity":"high","message":"transformers@5.2.0 (PyPI) is affected by PYSEC-2026-2289, GHSA-29pf-2h5f-8g72","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"transformers@5.2.0 (PyPI):GHSA-29pf-2h5f-8g72"},{"rule_id":"osv/GHSA-xrqw-3rrv-vx5w","severity":"high","message":"transformers@5.2.0 (PyPI) is affected by PYSEC-2026-3929, GHSA-xrqw-3rrv-vx5w","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"transformers@5.2.0 (PyPI):GHSA-xrqw-3rrv-vx5w"},{"rule_id":"osv/GHSA-x9r9-c232-4q39","severity":"high","message":"transformers@5.2.0 (PyPI) is affected by PYSEC-2026-4174, GHSA-x9r9-c232-4q39","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"transformers@5.2.0 (PyPI):GHSA-x9r9-c232-4q39"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436; also in native-cli/tokenizer/Cargo.lock","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/RUSTSEC-2026-0368","severity":"medium","message":"zip@8.6.0 (crates.io) is affected by RUSTSEC-2026-0368","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):RUSTSEC-2026-0368"},{"rule_id":"osv/GHSA-8hxf-qr8p-62x4","severity":"medium","message":"zip@8.6.0 (crates.io) is affected by GHSA-8hxf-qr8p-62x4","path":"native-cli/candle/Cargo.lock","line":null,"fingerprint":"zip@8.6.0 (crates.io):GHSA-8hxf-qr8p-62x4"},{"rule_id":"osv/PYSEC-2025-206","severity":"medium","message":"torch@2.8.0 (PyPI) is affected by PYSEC-2025-206","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):PYSEC-2025-206"},{"rule_id":"osv/GHSA-qfhq-4f3w-5fph","severity":"medium","message":"torch@2.8.0 (PyPI) is affected by GHSA-qfhq-4f3w-5fph","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):GHSA-qfhq-4f3w-5fph"},{"rule_id":"osv/GHSA-rrmf-rvhw-rf47","severity":"medium","message":"torch@2.8.0 (PyPI) is affected by GHSA-rrmf-rvhw-rf47","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):GHSA-rrmf-rvhw-rf47"},{"rule_id":"osv/GHSA-vgrw-7cvw-pwgx","severity":"medium","message":"torch@2.8.0 (PyPI) is affected by GHSA-vgrw-7cvw-pwgx","path":"native-cli/coreml/requirements.txt","line":null,"fingerprint":"torch@2.8.0 (PyPI):GHSA-vgrw-7cvw-pwgx"},{"rule_id":"osv/GHSA-6627-m3xw-93mp","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-6627-m3xw-93mp","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-6627-m3xw-93mp"},{"rule_id":"osv/GHSA-69hj-f68j-2879","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-69hj-f68j-2879","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-69hj-f68j-2879"},{"rule_id":"osv/GHSA-8mx5-7m5m-r77g","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-8mx5-7m5m-r77g","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-8mx5-7m5m-r77g"},{"rule_id":"osv/GHSA-9c4x-gm8v-wgc4","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-9c4x-gm8v-wgc4","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-9c4x-gm8v-wgc4"},{"rule_id":"osv/GHSA-cwqr-hh33-gh44","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-cwqr-hh33-gh44","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-cwqr-hh33-gh44"},{"rule_id":"osv/GHSA-fq56-3cx3-fjxp","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-fq56-3cx3-fjxp","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-fq56-3cx3-fjxp"},{"rule_id":"osv/GHSA-j8f7-rjxc-mr56","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-j8f7-rjxc-mr56","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-j8f7-rjxc-mr56"},{"rule_id":"osv/GHSA-m462-7rxw-wvpg","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-m462-7rxw-wvpg","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-m462-7rxw-wvpg"},{"rule_id":"osv/GHSA-rfpc-qcw5-3pc4","severity":"medium","message":"filelock@3.32.3 (PyPI) is affected by GHSA-rfpc-qcw5-3pc4","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-rfpc-qcw5-3pc4"},{"rule_id":"osv/GHSA-h35f-9h28-mq5c","severity":"medium","message":"setuptools@78.1.0 (PyPI) is affected by PYSEC-2026-3447, GHSA-h35f-9h28-mq5c","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"setuptools@78.1.0 (PyPI):GHSA-h35f-9h28-mq5c"},{"rule_id":"osv/GHSA-rrmf-rvhw-rf47","severity":"medium","message":"torch@2.10.0+cpu (PyPI) is affected by GHSA-rrmf-rvhw-rf47","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"torch@2.10.0+cpu (PyPI):GHSA-rrmf-rvhw-rf47"},{"rule_id":"osv/GHSA-567q-5qvw-pf92","severity":"low","message":"filelock@3.32.3 (PyPI) is affected by GHSA-567q-5qvw-pf92","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-567q-5qvw-pf92"},{"rule_id":"osv/GHSA-9vhv-jxww-xfm5","severity":"low","message":"filelock@3.32.3 (PyPI) is affected by GHSA-9vhv-jxww-xfm5","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"filelock@3.32.3 (PyPI):GHSA-9vhv-jxww-xfm5"},{"rule_id":"osv/GHSA-xmj3-9gf7-h52w","severity":"low","message":"setuptools@78.1.0 (PyPI) is affected by GHSA-xmj3-9gf7-h52w","path":"native-cli/onnx/export/requirements.txt","line":null,"fingerprint":"setuptools@78.1.0 (PyPI):GHSA-xmj3-9gf7-h52w"}],"evidence":[],"data":{"ecosystems":["PyPI","crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":10.0,"findings_high":8.0,"findings_medium":2.0,"findings_low":0.0,"penalty":98.4},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":44,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":51,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:51"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":58,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:58"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":72,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:72"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":78,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:78"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":22,"fingerprint":"artipacked:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":43,"fingerprint":"artipacked:.github/workflows/ci.yml:43"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.2143,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":10.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.6.4 ships deckard-v0.6.4-macos-arm64-app.tar.gz (6 downloads)","ref":"deckard-v0.6.4-macos-arm64-app.tar.gz","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.4/deckard-v0.6.4-macos-arm64-app.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.6.4 ships deckard-v0.6.4-macos-arm64.tar.gz (19 downloads)","ref":"deckard-v0.6.4-macos-arm64.tar.gz","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.4/deckard-v0.6.4-macos-arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.6.3 ships deckard-v0.6.3-macos-arm64-app.tar.gz (3 downloads)","ref":"deckard-v0.6.3-macos-arm64-app.tar.gz","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.3/deckard-v0.6.3-macos-arm64-app.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.6.3 ships deckard-v0.6.3-macos-arm64.tar.gz (6 downloads)","ref":"deckard-v0.6.3-macos-arm64.tar.gz","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.3/deckard-v0.6.3-macos-arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.6.2 ships deckard-v0.6.2-macos-arm64.tar.gz (2 downloads)","ref":"deckard-v0.6.2-macos-arm64.tar.gz","url":"https://github.com/sgoedecke/deckard/releases/download/v0.6.2/deckard-v0.6.2-macos-arm64.tar.gz","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":559.0,"function_nloc":7494.0,"mean_ccn":5.67,"p90_ccn":13.0,"complex_functions":46.0,"long_functions":8.0,"many_param_functions":5.0,"risky_nloc_share":0.392},"findings":[],"evidence":[{"kind":"complex-function","description":"aihider::uninstall in native-cli/src/main.cpp: complexity 83, 135 lines","ref":"native-cli/src/main.cpp","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/src/main.cpp#L483","weight":1.0},{"kind":"complex-function","description":"aihider::recover_setup in native-cli/src/setup.cpp: complexity 75, 116 lines","ref":"native-cli/src/setup.cpp","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/src/setup.cpp#L340","weight":1.0},{"kind":"complex-function","description":"scan in extension/content.js: complexity 72, 147 lines","ref":"extension/content.js","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/extension/content.js#L228","weight":1.0},{"kind":"complex-function","description":"aihider::install in native-cli/src/main.cpp: complexity 60, 195 lines","ref":"native-cli/src/main.cpp","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/src/main.cpp#L181","weight":1.0},{"kind":"complex-function","description":"compress in native-cli/coreml/q4.py: complexity 53, 137 lines","ref":"native-cli/coreml/q4.py","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/coreml/q4.py#L113","weight":0.8833333333333333},{"kind":"complex-function","description":"aihider::validate_release in native-cli/src/main.cpp: complexity 52, 84 lines","ref":"native-cli/src/main.cpp","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/src/main.cpp#L398","weight":0.8666666666666667},{"kind":"complex-function","description":"measure in native-cli/coreml/power_qos.py: complexity 38, 115 lines","ref":"native-cli/coreml/power_qos.py","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/coreml/power_qos.py#L37","weight":0.6333333333333333},{"kind":"complex-function","description":"handleContent in extension/service-worker.js: complexity 36, 75 lines","ref":"extension/service-worker.js","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/extension/service-worker.js#L353","weight":0.6},{"kind":"complex-function","description":"main in native-cli/coreml/profile_qos.py: complexity 36, 87 lines","ref":"native-cli/coreml/profile_qos.py","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/coreml/profile_qos.py#L32","weight":0.6},{"kind":"complex-function","description":"handlePopup in extension/service-worker.js: complexity 33, 71 lines","ref":"extension/service-worker.js","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/extension/service-worker.js#L228","weight":0.55}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":8066.0,"duplicated_lines":102.0,"duplicated_share":0.0126,"files":61.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: native-cli/bootstrap-linux.sh:54 and native-cli/bootstrap.sh:43","ref":"native-cli/bootstrap-linux.sh","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/bootstrap-linux.sh#L54","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native-cli/candle/src/lib.rs:44 and native-cli/tokenizer/src/lib.rs:57","ref":"native-cli/candle/src/lib.rs","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/candle/src/lib.rs#L44","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native-cli/coreml/compress.py:49 and native-cli/coreml/fuse.py:227","ref":"native-cli/coreml/compress.py","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/coreml/compress.py#L49","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native-cli/coreml/power_compare.py:70 and native-cli/coreml/power_qos.py:75","ref":"native-cli/coreml/power_compare.py","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/coreml/power_compare.py#L70","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native-cli/coreml/profile_instruments.py:53 and native-cli/coreml/profile_qos.py:32","ref":"native-cli/coreml/profile_instruments.py","url":"https://github.com/sgoedecke/deckard/blob/24a0f44ed57e2daaab47f02ad0ca14662bf4c610/native-cli/coreml/profile_instruments.py#L53","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"weighted_findings":19.75,"scanned_lines":9900.0,"category:best-practice":6.0,"category:correctness":4.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"native-cli/coreml/benchmark.py","line":166,"fingerprint":"python.lang.best-practice.arbitrary-sleep:native-cli/coreml/benchmark.py:166"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"native-cli/coreml/bounded.py","line":38,"fingerprint":"python.lang.best-practice.arbitrary-sleep:native-cli/coreml/bounded.py:38"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"native-cli/coreml/power_compare.py","line":74,"fingerprint":"python.lang.best-practice.arbitrary-sleep:native-cli/coreml/power_compare.py:74"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"native-cli/coreml/power_compare.py","line":108,"fingerprint":"python.lang.best-practice.arbitrary-sleep:native-cli/coreml/power_compare.py:108"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"native-cli/coreml/power_qos.py","line":79,"fingerprint":"python.lang.best-practice.arbitrary-sleep:native-cli/coreml/power_qos.py:79"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"native-cli/coreml/power_qos.py","line":124,"fingerprint":"python.lang.best-practice.arbitrary-sleep:native-cli/coreml/power_qos.py:124"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"extension/content.js","line":12,"fingerprint":"javascript.lang.correctness.no-replaceall:extension/content.js:12"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"extension/content.js","line":80,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:extension/content.js:80"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"extension/content.js","line":80,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:extension/content.js:80"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"extension/content.js","line":80,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:extension/content.js:80"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":7300.0,"source_lines":9900.0,"test_ratio":0.7374,"ci_files":1.0,"cochange_share":1.0,"cochange_commits":17.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test, npm run test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test","npm run test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":74.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":9900.0,"other_lines":0.0,"files_blamed":61.0,"blame_failures":0.0,"quality:ai_findings":10.0,"quality:ai_per_kloc":1.01,"quality:other_findings":0.0,"security:ai_findings":29.0,"security:ai_per_kloc":2.929,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}