{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.733860Z","repo":{"ref":{"host":"github.com","owner":"slavhate","name":"legacy-vault"},"default_branch":"main","clone_url":"https://github.com/slavhate/legacy-vault.git","html_url":"https://github.com/slavhate/legacy-vault","description":"Self-hosted, encrypted personal data vault for estate planning — store finances, legal docs, insurance, and final wishes with dead man's switch and beneficiary access","stars":14,"forks":1,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":183,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-04-09T18:31:32Z","pushed_at":"2026-04-24T13:50:19Z","security_policy_url":"https://github.com/slavhate/legacy-vault/security/policy","distribution":{"owner_created_at":"2021-01-21T08:03:12Z","owner_type":"User","release_assets":[]}},"commit_sha":"dca6f305c534207155b772734d47a6b1288fd3a1","profile":{"lines_by_language":{"JavaScript":1960,"Shell":199},"files_by_category":{"source":16,"config":5,"other":4,"docs":3,"binary":1},"source_lines":2159,"test_lines":0},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.73,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":50.6,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":95.3,"duplication":100.0,"lint":16.1,"testing":0.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 2% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing."},"security":{"score":52.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":0.2,"dependencies":null,"ci_actions":null,"posture":40.0,"scorecard":null},"summary":"Security posture is weak: 31 high-severity SAST findings. Weakest area: sast."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":7.0,"checked":7.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":12.0,"attributed_commits":12.0,"attributed_commit_share":1.0,"effective_loc":2174.0,"attributed_loc":2174.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 12 attributed commits, 2,174 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"dca6f305c534207155b772734d47a6b1288fd3a1","url":"https://github.com/slavhate/legacy-vault/commit/dca6f305c534207155b772734d47a6b1288fd3a1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"14c3cf7dd9085aeba499edaeeab31e91c47fc437","url":"https://github.com/slavhate/legacy-vault/commit/14c3cf7dd9085aeba499edaeeab31e91c47fc437","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8f328a3277c3671f5f0a1b9b4edbbf1c1d38acb3","url":"https://github.com/slavhate/legacy-vault/commit/8f328a3277c3671f5f0a1b9b4edbbf1c1d38acb3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6be10ecbdcbf0c7844f8044d9b8c6a401436c0fe","url":"https://github.com/slavhate/legacy-vault/commit/6be10ecbdcbf0c7844f8044d9b8c6a401436c0fe","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8148d287893830b6b7cb2e1603cea77441c9bcc8","url":"https://github.com/slavhate/legacy-vault/commit/8148d287893830b6b7cb2e1603cea77441c9bcc8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"441ea45c11f24ce07ddedf5e5b752b5dc161ce8f","url":"https://github.com/slavhate/legacy-vault/commit/441ea45c11f24ce07ddedf5e5b752b5dc161ce8f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"477736e2629987d014c8bcd73522df6f61500f50","url":"https://github.com/slavhate/legacy-vault/commit/477736e2629987d014c8bcd73522df6f61500f50","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d51248d73921eedae0a0796f8802528614c652fa","url":"https://github.com/slavhate/legacy-vault/commit/d51248d73921eedae0a0796f8802528614c652fa","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"03946c6136e7914834eb5ac376ede3697db1c236","url":"https://github.com/slavhate/legacy-vault/commit/03946c6136e7914834eb5ac376ede3697db1c236","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9402dbbb7477f5dfde30f30dd9ecc9e2b8bb6b07","url":"https://github.com/slavhate/legacy-vault/commit/9402dbbb7477f5dfde30f30dd9ecc9e2b8bb6b07","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b4d591760a16f3926fd66426d632e1843af1b5d7","url":"https://github.com/slavhate/legacy-vault/commit/b4d591760a16f3926fd66426d632e1843af1b5d7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c3488cdd3dcfc12b1aa0795333ef6e8ee9d8f914","url":"https://github.com/slavhate/legacy-vault/commit/c3488cdd3dcfc12b1aa0795333ef6e8ee9d8f914","weight":0.9}],"data":{"attributed_loc_by_commit":{"c3488cdd3dcfc12b1aa0795333ef6e8ee9d8f914":2153,"b4d591760a16f3926fd66426d632e1843af1b5d7":1,"9402dbbb7477f5dfde30f30dd9ecc9e2b8bb6b07":12,"03946c6136e7914834eb5ac376ede3697db1c236":0,"d51248d73921eedae0a0796f8802528614c652fa":0,"477736e2629987d014c8bcd73522df6f61500f50":0,"441ea45c11f24ce07ddedf5e5b752b5dc161ce8f":0,"8148d287893830b6b7cb2e1603cea77441c9bcc8":0,"6be10ecbdcbf0c7844f8044d9b8c6a401436c0fe":2,"8f328a3277c3671f5f0a1b9b4edbbf1c1d38acb3":0,"14c3cf7dd9085aeba499edaeeab31e91c47fc437":2,"dca6f305c534207155b772734d47a6b1288fd3a1":4},"tools":{"claude-code":{"name":"Claude Code","commits":12,"loc":2174,"first_seen":1775759430,"last_seen":1777038502}},"monthly":{"2026-04":{"loc":2174,"attributed_loc":2174}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":4.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":21.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":2.7885360185902406,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":2153.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["c3488cdd3dcfc12b1aa0795333ef6e8ee9d8f914"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2159.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":75.0,"findings_high":31.0,"findings_medium":43.0,"findings_low":1.0,"weighted_findings":37.212,"scanned_lines":2159.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":37,"fingerprint":"dockerfile.security.missing-user:Dockerfile:37"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":40,"fingerprint":"dockerfile.security.missing-user:Dockerfile:40"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":254,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:254"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":254,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:254"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":341,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:341"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":341,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:341"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":390,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:390"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":390,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:390"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":435,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:435"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":435,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:435"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":512,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:512"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":512,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:512"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":605,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:605"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":605,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:605"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":656,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:656"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":656,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:656"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":729,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:729"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$('#restore-result').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":729,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:729"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":748,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:748"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":748,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:748"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":790,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:790"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `result.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":790,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:790"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":791,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:791"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `result.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":791,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:791"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":797,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:797"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `result.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":797,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:797"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":799,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:799"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `result.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":799,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:799"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":827,"fingerprint":"javascript.browser.security.insecure-document-method:public/js/app.js:827"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `app.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"public/js/app.js","line":827,"fingerprint":"javascript.browser.security.insecure-innerhtml:public/js/app.js:827"},{"rule_id":"opengrep/javascript.node-crypto.security.gcm-no-tag-length","severity":"high","message":"The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authenticatio [confidence medium]","path":"server/crypto.js","line":27,"fingerprint":"javascript.node-crypto.security.gcm-no-tag-length:server/crypto.js:27"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":148,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:148"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":149,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:149"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":191,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:191"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":247,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:247"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":254,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:254"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":262,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:262"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":285,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:285"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":300,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:300"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":302,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:302"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":304,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:304"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":307,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:307"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":330,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:330"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":336,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:336"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":339,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:339"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":366,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:366"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":372,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:372"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":381,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:381"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":383,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:383"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":423,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:423"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":425,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:425"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":426,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:426"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":428,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:428"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":430,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:430"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":432,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:432"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":435,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:435"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":489,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:489"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":497,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:497"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":498,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:498"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":498,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:498"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":615,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:615"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":656,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:656"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":729,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:729"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":740,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:740"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":757,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:757"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":790,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:790"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":791,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:791"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":797,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:797"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":799,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:799"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":807,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:807"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":815,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:815"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":818,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:818"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":820,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:820"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"public/js/app.js","line":821,"fingerprint":"javascript.lang.security.html-in-template-string:public/js/app.js:821"},{"rule_id":"opengrep/javascript.express.security.audit.express-check-csurf-middleware-usage","severity":"low","message":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies. [confidence low]","path":"server/index.js","line":12,"fingerprint":"javascript.express.security.audit.express-check-csurf-middleware-usage:server/index.js:12"}],"evidence":[],"data":{"rulesets":["javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":181.0,"function_nloc":1482.0,"mean_ccn":2.81,"p90_ccn":6.0,"complex_functions":1.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0162},"findings":[],"evidence":[{"kind":"complex-function","description":"handleRoute in public/js/app.js: complexity 17, 24 lines","ref":"public/js/app.js","url":"https://github.com/slavhate/legacy-vault/blob/dca6f305c534207155b772734d47a6b1288fd3a1/public/js/app.js#L62","weight":0.2833333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1699.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":16.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":51.0,"weighted_findings":15.75,"scanned_lines":2159.0,"category:best-practice":4.0,"category:correctness":47.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"public/js/app.js","line":403,"fingerprint":"javascript.lang.best-practice.javascript-confirm:public/js/app.js:403"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"public/js/app.js","line":539,"fingerprint":"javascript.lang.best-practice.javascript-confirm:public/js/app.js:539"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"public/js/app.js","line":545,"fingerprint":"javascript.lang.best-practice.javascript-confirm:public/js/app.js:545"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"public/js/app.js","line":723,"fingerprint":"javascript.lang.best-practice.javascript-confirm:public/js/app.js:723"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":153,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:153"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":153,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:153"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":157,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:157"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":161,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:161"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":161,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:161"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":161,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:161"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":171,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:171"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":174,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:174"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":177,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:177"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":180,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:180"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":254,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:254"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":254,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:254"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":285,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:285"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":285,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:285"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":512,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:512"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":512,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:512"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":605,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:605"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":605,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:605"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":656,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:656"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":656,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:656"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":748,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:748"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":748,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:748"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":764,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:764"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"public/js/app.js","line":764,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:public/js/app.js:764"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"seed.sh","line":124,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:seed.sh:124"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"seed.sh","line":130,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:seed.sh:130"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"seed.sh","line":136,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:seed.sh:136"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/auth.js","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/auth.js:4"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/auth.js","line":5,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/auth.js:5"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/beneficiaries.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/beneficiaries.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/beneficiaries.js","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/beneficiaries.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/beneficiaries.js","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/beneficiaries.js:4"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/deadswitch.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/deadswitch.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/deadswitch.js","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/deadswitch.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/vault.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/vault.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/vault.js","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/vault.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"server/routes/vault.js","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:server/routes/vault.js:4"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":2159.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":6.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":216.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2159.0,"other_lines":0.0,"files_blamed":16.0,"blame_failures":0.0,"quality:ai_findings":51.0,"quality:ai_per_kloc":23.622,"quality:other_findings":0.0,"security:ai_findings":73.0,"security:ai_per_kloc":33.812,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}