{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.724835Z","repo":{"ref":{"host":"github.com","owner":"skyachieved","name":"Horologium"},"default_branch":"main","clone_url":"https://github.com/skyachieved/Horologium.git","html_url":"https://github.com/skyachieved/Horologium","description":null,"stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3470,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-10-15T05:14:21Z","pushed_at":"2026-10-28T17:09:42Z","security_policy_url":null,"distribution":{"owner_created_at":"2022-10-13T04:15:48Z","owner_type":"User","release_assets":[]}},"commit_sha":"dc0db4af05ec7af09f0198db0e2e28d882d7f361","profile":{"lines_by_language":{"JavaScript":12505},"files_by_category":{"source":90,"config":89,"test":28,"other":20,"binary":15,"docs":10,"generated":1,"oversized":1},"source_lines":9785,"test_lines":2720},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.71,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":2.0,"flagged_work_units":1.0,"flagged_releases":null,"style_index":0.204},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":76.5,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":64.1,"duplication":97.7,"lint":75.5,"testing":78.9,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.28, CI runs tests; 15% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity."},"security":{"score":71.9,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":82.9,"dependencies":90.5,"ci_actions":33.3,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 2 known vulnerabilities in 2 dependencies; 3 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":3.0,"checked":3.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":6.0,"attributed_commits":5.0,"attributed_commit_share":0.8333333333333334,"effective_loc":12751.0,"attributed_loc":12751.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 5 attributed commits, 12,751 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"dc0db4af05ec7af09f0198db0e2e28d882d7f361","url":"https://github.com/skyachieved/Horologium/commit/dc0db4af05ec7af09f0198db0e2e28d882d7f361","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b7c6e4d22837f4df23a2bfcc8e01b56d598ae31d","url":"https://github.com/skyachieved/Horologium/commit/b7c6e4d22837f4df23a2bfcc8e01b56d598ae31d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2f6526cd05f922e7cfe18ad9b47def1e8589af1f","url":"https://github.com/skyachieved/Horologium/commit/2f6526cd05f922e7cfe18ad9b47def1e8589af1f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4a1de6abb2554c84c86661627ba915cdca0bf7c8","url":"https://github.com/skyachieved/Horologium/commit/4a1de6abb2554c84c86661627ba915cdca0bf7c8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f9d4325346936217fe70990b09ab59ae61730168","url":"https://github.com/skyachieved/Horologium/commit/f9d4325346936217fe70990b09ab59ae61730168","weight":0.9}],"data":{"attributed_loc_by_commit":{"f9d4325346936217fe70990b09ab59ae61730168":10470,"4a1de6abb2554c84c86661627ba915cdca0bf7c8":0,"2f6526cd05f922e7cfe18ad9b47def1e8589af1f":11,"b7c6e4d22837f4df23a2bfcc8e01b56d598ae31d":2270,"dc0db4af05ec7af09f0198db0e2e28d882d7f361":0},"tools":{"claude-code":{"name":"Claude Code","commits":5,"loc":12751,"first_seen":1792054988,"last_seen":1793207379}},"monthly":{"2026-10":{"loc":12751,"attributed_loc":12751}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1792054988.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1792054988},{"tool":"generic-agent","path":"AGENTS.md","added_at":1792054988}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":1.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2281.0,"flagged_loc":2281.0,"flagged_loc_share":1.0,"max_loc_per_hour":569.4985782647896,"median_loc_per_hour":569.4985782647896,"pr_timed_units":0.0,"excluded_import_loc":10470.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,281 lines of first-party code in ~4.0h (569 lines/hour, 2 commit session)","ref":"b7c6e4d22837f4df23a2bfcc8e01b56d598ae31d","url":"https://github.com/skyachieved/Horologium/commit/b7c6e4d22837f4df23a2bfcc8e01b56d598ae31d","weight":0.17084957347943686}],"data":{"flagged_loc_by_commit":{"2f6526cd05f922e7cfe18ad9b47def1e8589af1f":11,"b7c6e4d22837f4df23a2bfcc8e01b56d598ae31d":2270},"excluded_import_commits":["f9d4325346936217fe70990b09ab59ae61730168"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":9785.0,"index":0.204,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":1.0,"per_kloc:placeholder":0.102,"files:placeholder":1.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:placeholder","description":"placeholder or demo-only phrasing: biquad('lowpass', 900, 0.707, sampleRate)(data); // a soft, dark hush: replace this with your own sound","ref":"templates/layer-dsp/index.js:17","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/templates/layer-dsp/index.js#L17","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":15.0,"findings_high":3.0,"findings_medium":12.0,"findings_low":0.0,"weighted_findings":5.25,"scanned_lines":9785.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.express.security.audit.remote-property-injection","severity":"high","message":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]","path":"extensions/music-sources/generated/synth/engine.js","line":28,"fingerprint":"javascript.express.security.audit.remote-property-injection:extensions/music-sources/generated/synth/engine.js:28"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/renderer/js/dom.js","line":46,"fingerprint":"javascript.browser.security.insecure-document-method:src/renderer/js/dom.js:46"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tpl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/renderer/js/dom.js","line":46,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/renderer/js/dom.js:46"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"extensions/music-sources/generated/synth/drums.js","line":165,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:extensions/music-sources/generated/synth/drums.js:165"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/core/sprite.js","line":44,"fingerprint":"javascript.lang.security.html-in-template-string:src/core/sprite.js:44"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/core/sprite.js","line":57,"fingerprint":"javascript.lang.security.html-in-template-string:src/core/sprite.js:57"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/core/sprite.js","line":62,"fingerprint":"javascript.lang.security.html-in-template-string:src/core/sprite.js:62"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/core/sprite.js","line":65,"fingerprint":"javascript.lang.security.html-in-template-string:src/core/sprite.js:65"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"src/main/extensions.js","line":146,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/main/extensions.js:146"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"src/renderer/js/app-state.js","line":63,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:src/renderer/js/app-state.js:63"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/renderer/js/icons.js","line":34,"fingerprint":"javascript.lang.security.html-in-template-string:src/renderer/js/icons.js:34"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"tools/audio-qa.js","line":49,"fingerprint":"javascript.lang.security.insecure-object-assign:tools/audio-qa.js:49"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"tools/new-extension.js","line":50,"fingerprint":"javascript.lang.security.html-in-template-string:tools/new-extension.js:50"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"tools/scaffold.js","line":72,"fingerprint":"javascript.lang.security.html-in-template-string:tools/scaffold.js:72"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `l` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]","path":"tools/ui-check.js","line":206,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:tools/ui-check.js:206"}],"evidence":[],"data":{"rulesets":["javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":2.0,"vulnerabilities":2.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":2.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":6.0},"findings":[{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":8.0,"findings_high":6.0,"findings_medium":2.0,"findings_low":0.0,"penalty":66.0},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/release.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/release.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/release.yml:36"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":24,"fingerprint":"cache-poisoning:.github/workflows/release.yml:24"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":21,"fingerprint":"artipacked:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":23,"fingerprint":"artipacked:.github/workflows/release.yml:23"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.1667,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1252.0,"function_nloc":7531.0,"mean_ccn":2.66,"p90_ccn":5.0,"complex_functions":20.0,"long_functions":3.0,"many_param_functions":0.0,"risky_nloc_share":0.1483},"findings":[],"evidence":[{"kind":"complex-function","description":"validate in src/core/schema.js: complexity 57, 72 lines","ref":"src/core/schema.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/src/core/schema.js#L22","weight":0.95},{"kind":"complex-function","description":"checkStation in src/main/extensions.js: complexity 35, 42 lines","ref":"src/main/extensions.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/src/main/extensions.js#L224","weight":0.5833333333333334},{"kind":"complex-function","description":"loadThemes in src/main/extensions.js: complexity 31, 75 lines","ref":"src/main/extensions.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/src/main/extensions.js#L118","weight":0.5166666666666667},{"kind":"complex-function","description":"scaffoldGenerated in tools/scaffold.js: complexity 29, 72 lines","ref":"tools/scaffold.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/tools/scaffold.js#L48","weight":0.48333333333333334},{"kind":"complex-function","description":"handle in src/main/protocol.js: complexity 22, 55 lines","ref":"src/main/protocol.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/src/main/protocol.js#L63","weight":0.36666666666666664},{"kind":"complex-function","description":"key in tools/ui-check.js: complexity 22, 112 lines","ref":"tools/ui-check.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/tools/ui-check.js#L83","weight":0.36666666666666664},{"kind":"complex-function","description":"compareVersions in src/core/updates.js: complexity 21, 21 lines","ref":"src/core/updates.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/src/core/updates.js#L21","weight":0.35},{"kind":"complex-function","description":"renderCard in src/renderer/js/views/news.js: complexity 21, 39 lines","ref":"src/renderer/js/views/news.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/src/renderer/js/views/news.js#L26","weight":0.35},{"kind":"complex-function","description":"loadGenerated in src/main/extensions.js: complexity 20, 50 lines","ref":"src/main/extensions.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/src/main/extensions.js#L290","weight":0.3333333333333333},{"kind":"complex-function","description":"composeChords in extensions/music-sources/generated/compose/compose.js: complexity 19, 31 lines","ref":"extensions/music-sources/generated/compose/compose.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/extensions/music-sources/generated/compose/compose.js#L144","weight":0.31666666666666665}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":7277.0,"duplicated_lines":28.0,"duplicated_share":0.0038,"files":90.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: extensions/music-sources/generated/compose/compose.js:160 and extensions/music-sources/generated/compose/compose.js:222","ref":"extensions/music-sources/generated/compose/compose.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/extensions/music-sources/generated/compose/compose.js#L160","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: extensions/music-sources/generated/instruments/kit-soft.js:6 and templates/instrument/kit.js:10","ref":"extensions/music-sources/generated/instruments/kit-soft.js","url":"https://github.com/skyachieved/Horologium/blob/dc0db4af05ec7af09f0198db0e2e28d882d7f361/extensions/music-sources/generated/instruments/kit-soft.js#L6","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":26.0,"weighted_findings":11.0,"scanned_lines":9785.0,"category:correctness":26.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"extensions/music-sources/generated/compose/compose.js","line":57,"fingerprint":"javascript.lang.correctness.no-stringify-keys:extensions/music-sources/generated/compose/compose.js:57"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"extensions/music-sources/generated/compose/compose.js","line":60,"fingerprint":"javascript.lang.correctness.no-stringify-keys:extensions/music-sources/generated/compose/compose.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"extensions/music-sources/generated/compose/compose.js","line":61,"fingerprint":"javascript.lang.correctness.no-stringify-keys:extensions/music-sources/generated/compose/compose.js:61"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"extensions/music-sources/generated/compose/compose.js","line":61,"fingerprint":"javascript.lang.correctness.no-stringify-keys:extensions/music-sources/generated/compose/compose.js:61"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/core/defaults.js","line":87,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/core/defaults.js:87"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/core/defaults.js","line":88,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/core/defaults.js:88"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"extensions/music-sources/local-files/index.js","line":233,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:extensions/music-sources/local-files/index.js:233"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"extensions/music-sources/local-files/index.js","line":233,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:extensions/music-sources/local-files/index.js:233"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"extensions/music-sources/local-files/index.js","line":239,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:extensions/music-sources/local-files/index.js:239"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"extensions/music-sources/local-files/index.js","line":239,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:extensions/music-sources/local-files/index.js:239"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/schema.js","line":67,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/schema.js:67"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/core/schema.js","line":67,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/core/schema.js:67"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/main/miniplayer.js","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/main/miniplayer.js:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/main/miniplayer.js","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/main/miniplayer.js:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/renderer/js/views/profile-form.js","line":60,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/renderer/js/views/profile-form.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/renderer/js/views/profile-form.js","line":60,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/renderer/js/views/profile-form.js:60"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":87,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:87"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":87,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:87"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":135,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:135"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":135,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:135"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":146,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:146"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":202,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:202"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":202,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:202"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":206,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:206"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":206,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:206"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/ui-check.js","line":206,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/ui-check.js:206"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.556,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":2720.0,"source_lines":9785.0,"test_ratio":0.278,"ci_files":2.0,"cochange_share":1.0,"cochange_commits":2.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":101.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":9785.0,"other_lines":0.0,"files_blamed":90.0,"blame_failures":0.0,"quality:ai_findings":26.0,"quality:ai_per_kloc":2.657,"quality:other_findings":0.0,"security:ai_findings":15.0,"security:ai_per_kloc":1.533,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}