{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:55:45.435191Z","repo":{"ref":{"host":"github.com","owner":"speedarr","name":"Speedarr"},"default_branch":"main","clone_url":"https://github.com/speedarr/Speedarr.git","html_url":"https://github.com/speedarr/Speedarr","description":"Smooth streams first, downloads and seeding with what's left","stars":25,"forks":1,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":4074,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-02-05T02:18:20Z","pushed_at":"2026-11-13T18:55:48Z","security_policy_url":null,"distribution":{"owner_created_at":"2026-02-05T02:15:24Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"9dc6c14600747ebcbdbc53460faabae33dbd52b2","profile":{"lines_by_language":{"TypeScript":17898,"Python":17385,"JavaScript":108,"Shell":26},"files_by_category":{"source":151,"test":64,"config":13,"docs":5,"other":5,"binary":4,"generated":1},"source_lines":30224,"test_lines":5193},"pillars":{"ai_provenance":{"score":1.1,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0105,"suspected_share":0.0462,"estimated_share":0.0105,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals."},"quality":{"score":50.4,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":37.6,"duplication":53.1,"lint":41.9,"testing":53.6,"docs":65.0,"type_safety":74.3,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.17, no CI test run detected; 33% of function code in complex or long functions; 11% duplicated lines. Weakest area: complexity."},"security":{"score":58.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":88.0,"dependencies":25.9,"ci_actions":5.8,"posture":40.0,"scorecard":null},"summary":"Security posture is weak: 40 known vulnerabilities in 12 dependencies; 7 high-severity SAST findings; 14 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":61.0,"checked":61.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":209.0,"attributed_commits":11.0,"attributed_commit_share":0.05263157894736842,"effective_loc":42066.0,"attributed_loc":442.0,"attributed_loc_share":0.010507298055436695,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 11 attributed commits, 442 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7a982eeaa581f9b1032bedf0cfc72c07bcb49f0e","url":"https://github.com/speedarr/Speedarr/commit/7a982eeaa581f9b1032bedf0cfc72c07bcb49f0e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"23bae15e3bc32d7525dd042ad8da026e8a85cad2","url":"https://github.com/speedarr/Speedarr/commit/23bae15e3bc32d7525dd042ad8da026e8a85cad2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"41b97c3fba7e9479aa2a612f1d53a5bf72e2e11b","url":"https://github.com/speedarr/Speedarr/commit/41b97c3fba7e9479aa2a612f1d53a5bf72e2e11b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"62aab996a9e77c0730ffb352a86a4794a072b09c","url":"https://github.com/speedarr/Speedarr/commit/62aab996a9e77c0730ffb352a86a4794a072b09c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1652d3e20ac655728339ca87a09cff876ebbf016","url":"https://github.com/speedarr/Speedarr/commit/1652d3e20ac655728339ca87a09cff876ebbf016","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"28b864d5e24355dc30850fff818919df1a7d1b9c","url":"https://github.com/speedarr/Speedarr/commit/28b864d5e24355dc30850fff818919df1a7d1b9c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3aa8665d2aa4de067e656564d21a02d669a3a3f8","url":"https://github.com/speedarr/Speedarr/commit/3aa8665d2aa4de067e656564d21a02d669a3a3f8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ffb12ff4d371675b4bcca0fe34bcd184a90e8087","url":"https://github.com/speedarr/Speedarr/commit/ffb12ff4d371675b4bcca0fe34bcd184a90e8087","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4c14629624479a954cd2fde4dc7f39cf1c535b9b","url":"https://github.com/speedarr/Speedarr/commit/4c14629624479a954cd2fde4dc7f39cf1c535b9b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"31aa73a3616a9b12406cad3d2f2b5bbe1d45c752","url":"https://github.com/speedarr/Speedarr/commit/31aa73a3616a9b12406cad3d2f2b5bbe1d45c752","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"023c2dcf61340710aa002a218c65ab156f1828a6","url":"https://github.com/speedarr/Speedarr/commit/023c2dcf61340710aa002a218c65ab156f1828a6","weight":0.9}],"data":{"attributed_loc_by_commit":{"023c2dcf61340710aa002a218c65ab156f1828a6":58,"31aa73a3616a9b12406cad3d2f2b5bbe1d45c752":9,"4c14629624479a954cd2fde4dc7f39cf1c535b9b":23,"ffb12ff4d371675b4bcca0fe34bcd184a90e8087":0,"3aa8665d2aa4de067e656564d21a02d669a3a3f8":111,"28b864d5e24355dc30850fff818919df1a7d1b9c":20,"1652d3e20ac655728339ca87a09cff876ebbf016":71,"62aab996a9e77c0730ffb352a86a4794a072b09c":1,"41b97c3fba7e9479aa2a612f1d53a5bf72e2e11b":3,"23bae15e3bc32d7525dd042ad8da026e8a85cad2":137,"7a982eeaa581f9b1032bedf0cfc72c07bcb49f0e":9},"tools":{"claude-code":{"name":"Claude Code","commits":11,"loc":442,"first_seen":1770792230,"last_seen":1771031232}},"monthly":{"2026-02":{"loc":27953,"attributed_loc":442},"2026-03":{"loc":200,"attributed_loc":0},"2026-05":{"loc":26,"attributed_loc":0},"2026-06":{"loc":6937,"attributed_loc":0},"2026-07":{"loc":125,"attributed_loc":0},"2026-08":{"loc":1576,"attributed_loc":0},"2026-09":{"loc":5249,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":50.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":16567.0,"flagged_loc":1942.0,"flagged_loc_share":0.11722098146918573,"max_loc_per_hour":609.2889005510365,"median_loc_per_hour":103.78457104306332,"pr_timed_units":0.0,"excluded_import_loc":25499.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,942 lines of first-party code in ~3.3h (584 lines/hour, 13 commit session)","ref":"05e8941c36e4f04b12e64724ae1f00c7d92bf90f","url":"https://github.com/speedarr/Speedarr/commit/05e8941c36e4f04b12e64724ae1f00c7d92bf90f","weight":0.17505717385860944}],"data":{"flagged_loc_by_commit":{"1dce229e9fafb1e01dfb0ddbd4a2ff218057586c":24,"7a1acd27b5efb2e79347d9d0ec4b2ae6715c1069":16,"b46f96fb102e515d04716557cd5d8aa73708d9e1":223,"34e4080932d5d3c3e1ba6e43f646f32da738e18e":218,"3bdefa603bd75101be6b145267c9ea352e582331":191,"337f812034ba509a49dc545e12e51de948804624":137,"a1f7e54162fcddf369bf10171a12cfa925154d72":13,"15b2920a3636ae90a847bff26c3c40d0db11625e":309,"29b56dd0c0c02ad1b6cc4baa95bc6bfc4c62a367":4,"95ea549f02ac8fe4f9df2828b7c1e31661e8685a":10,"481046c51d5449368eaf187fc18543ee2c3a5773":5,"449492ab2f3f36315e0fd9f6d4ac5130ae889c1c":771,"05e8941c36e4f04b12e64724ae1f00c7d92bf90f":21},"excluded_import_commits":["021df07d0bf9ce5e91963eccad5edd51a0506dcc"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":20.0,"flagged_releases":0.0,"max_loc_per_day":1633.2},"findings":[],"evidence":[],"data":{"releases":[{"from":"v2026.02.05","to":"v2026.02.05.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2026.02.05.1","to":"v2026.02.05.2","loc":20,"days":0.04,"loc_per_day":464.9,"flagged":false},{"from":"v2026.02.05.2","to":"v2026.02.05.3","loc":5,"days":0.09,"loc_per_day":58.2,"flagged":false},{"from":"v2026.02.05.3","to":"v2026.02.06","loc":7,"days":0.64,"loc_per_day":11.0,"flagged":false},{"from":"v2026.02.06","to":"v2026.02.11","loc":0,"days":2.25,"loc_per_day":0.0,"flagged":false},{"from":"v2026.02.11","to":"v2026.02.11.01","loc":67,"days":3.16,"loc_per_day":21.2,"flagged":false},{"from":"v2026.02.11.01","to":"v2026.02.12","loc":23,"days":0.95,"loc_per_day":24.1,"flagged":false},{"from":"v2026.02.12","to":"v2026.02.12.01","loc":131,"days":0.08,"loc_per_day":1633.2,"flagged":false},{"from":"v2026.02.12.01","to":"v2026.02.12.02","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2026.02.12.02","to":"v2026.02.13","loc":71,"days":0.52,"loc_per_day":135.5,"flagged":false},{"from":"v2026.02.13","to":"v2026.02.13.01","loc":4,"days":0.31,"loc_per_day":12.9,"flagged":false},{"from":"v2026.02.13.01","to":"v2026.02.13.02","loc":137,"days":0.15,"loc_per_day":897.7,"flagged":false},{"from":"v2026.02.13.02","to":"v2026.02.14","loc":9,"days":0.77,"loc_per_day":11.7,"flagged":false},{"from":"v2026.02.14","to":"v2026.02.15","loc":1268,"days":0.94,"loc_per_day":1351.1,"flagged":false},{"from":"v2026.02.15","to":"v2026.02.16","loc":660,"days":0.84,"loc_per_day":788.2,"flagged":false},{"from":"v2026.02.16","to":"v2026.02.24","loc":52,"days":7.98,"loc_per_day":6.5,"flagged":false},{"from":"v2026.02.24","to":"v2026.05.15","loc":13,"days":80.08,"loc_per_day":0.2,"flagged":false},{"from":"v2026.05.15","to":"v2026.06.12","loc":538,"days":28.17,"loc_per_day":19.1,"flagged":false},{"from":"v2026.06.12","to":"v2026.07.07","loc":6737,"days":24.89,"loc_per_day":270.6,"flagged":false},{"from":"v2026.07.07","to":"v2026.09.21","loc":6825,"days":76.0,"loc_per_day":89.8,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":30224.0,"index":0.165,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.033,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":8.0,"per_kloc:emoji_in_code":0.265,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # First, walk interface names to filter early","ref":"backend/app/services/snmp_monitor.py:561","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/services/snmp_monitor.py#L561","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"findings_high":7.0,"findings_medium":2.0,"findings_low":0.0,"weighted_findings":11.0,"scanned_lines":30224.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"backend/Dockerfile","line":104,"fingerprint":"dockerfile.security.missing-user-entrypoint:backend/Dockerfile:104"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"backend/Dockerfile","line":105,"fingerprint":"dockerfile.security.missing-user:backend/Dockerfile:105"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"backend/app/clients/plex.py","line":7,"fingerprint":"python.lang.security.use-defused-xml:backend/app/clients/plex.py:7"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"backend/app/database.py","line":88,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:backend/app/database.py:88"},{"rule_id":"opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text","severity":"high","message":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]","path":"backend/app/database.py","line":134,"fingerprint":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text:backend/app/database.py:134"},{"rule_id":"opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text","severity":"high","message":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]","path":"backend/app/database.py","line":196,"fingerprint":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text:backend/app/database.py:196"},{"rule_id":"opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text","severity":"high","message":"sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]","path":"backend/app/database.py","line":201,"fingerprint":"python.sqlalchemy.security.audit.avoid-sqlalchemy-text:backend/app/database.py:201"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"backend/app/database.py","line":88,"fingerprint":"python.lang.security.audit.formatted-sql-query:backend/app/database.py:88"},{"rule_id":"opengrep/typescript.react.security.audit.react-href-var","severity":"medium","message":"Detected a variable used in an anchor tag with the 'href' attribute. A malicious actor may be able to input the 'javascript:' URI, which could cause cross-site scripting (XSS). It is recommended to disallow 'javascript:' URIs within your application. [confidence low]","path":"frontend/src/components/settings/MediaServerSettings.tsx","line":75,"fingerprint":"typescript.react.security.audit.react-href-var:frontend/src/components/settings/MediaServerSettings.tsx:75"}],"evidence":[],"data":{"rulesets":["typescript","javascript","python","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":12.0,"vulnerabilities":40.0,"vulns_critical":0.0,"vulns_high":20.0,"vulns_medium":18.0,"vulns_low":2.0,"vulns_unknown":0.0,"penalty":81.0},"findings":[{"rule_id":"osv/GHSA-x33g-cr3x-6449","severity":"high","message":"pyjwt@2.14.0 (PyPI) is affected by PYSEC-2026-4183, GHSA-x33g-cr3x-6449; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"pyjwt@2.14.0 (PyPI):GHSA-x33g-cr3x-6449"},{"rule_id":"osv/GHSA-2g87-pp6c-29x5","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-2g87-pp6c-29x5; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-2g87-pp6c-29x5"},{"rule_id":"osv/GHSA-5wr8-gcqf-gqf3","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-5wr8-gcqf-gqf3; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-5wr8-gcqf-gqf3"},{"rule_id":"osv/GHSA-9xw5-w5jj-pvcg","severity":"high","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-9xw5-w5jj-pvcg; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-9xw5-w5jj-pvcg"},{"rule_id":"osv/GHSA-2qm8-x737-gmw5","severity":"high","message":"pyasn1@0.6.4 (PyPI) is affected by GHSA-2qm8-x737-gmw5; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"pyasn1@0.6.4 (PyPI):GHSA-2qm8-x737-gmw5"},{"rule_id":"osv/GHSA-9m75-vc3g-4x39","severity":"high","message":"pyasn1@0.6.4 (PyPI) is affected by GHSA-9m75-vc3g-4x39; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"pyasn1@0.6.4 (PyPI):GHSA-9m75-vc3g-4x39"},{"rule_id":"osv/GHSA-fm9c-5rcf-2q5p","severity":"high","message":"pyasn1@0.6.4 (PyPI) is affected by GHSA-fm9c-5rcf-2q5p; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"pyasn1@0.6.4 (PyPI):GHSA-fm9c-5rcf-2q5p"},{"rule_id":"osv/GHSA-mm57-4v3p-rchx","severity":"high","message":"pyasn1@0.6.4 (PyPI) is affected by GHSA-mm57-4v3p-rchx; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"pyasn1@0.6.4 (PyPI):GHSA-mm57-4v3p-rchx"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-8r9p-f939-6h3c","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-8r9p-f939-6h3c","path":"frontend/package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-8r9p-f939-6h3c"},{"rule_id":"osv/GHSA-mrwp-f3q8-3g9p","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-mrwp-f3q8-3g9p","path":"frontend/package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-mrwp-f3q8-3g9p"},{"rule_id":"osv/GHSA-q3jh-wrc6-jgq8","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-q3jh-wrc6-jgq8","path":"frontend/package-lock.json","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-q3jh-wrc6-jgq8"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"frontend/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@8.10.2 (npm) is affected by GHSA-xjj6-f33q-929c","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.2.2 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.6.1 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"frontend/package-lock.json","line":null,"fingerprint":"zod@4.6.1 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-42vr-xj54-vc7v","severity":"medium","message":"pyjwt@2.14.0 (PyPI) is affected by PYSEC-2026-4141, GHSA-42vr-xj54-vc7v; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"pyjwt@2.14.0 (PyPI):GHSA-42vr-xj54-vc7v"},{"rule_id":"osv/GHSA-494j-54xm-rwp3","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-494j-54xm-rwp3; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-494j-54xm-rwp3"},{"rule_id":"osv/GHSA-6cjc-53gc-5rqm","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-6cjc-53gc-5rqm; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-6cjc-53gc-5rqm"},{"rule_id":"osv/GHSA-f9xw-jh8m-3mwq","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-f9xw-jh8m-3mwq; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-f9xw-jh8m-3mwq"},{"rule_id":"osv/GHSA-pqxq-w44r-73xw","severity":"medium","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-pqxq-w44r-73xw; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-pqxq-w44r-73xw"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.11 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"frontend/package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.11 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-xp26-3454-mjgp","severity":"medium","message":"@vitest/mocker@4.1.11 (npm) is affected by GHSA-xp26-3454-mjgp","path":"frontend/package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.11 (npm):GHSA-xp26-3454-mjgp"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.9 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"frontend/package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.9 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"frontend/package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@6.1.4 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"frontend/package-lock.json","line":null,"fingerprint":"postcss-selector-parser@6.1.4 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@8.10.2 (npm) is affected by GHSA-f72v-6w45-q472","path":"frontend/package-lock.json","line":null,"fingerprint":"undici@8.10.2 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-vfpm-58rq-9qcg","severity":"medium","message":"vite@8.2.2 (npm) is affected by GHSA-vfpm-58rq-9qcg","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-vfpm-58rq-9qcg"},{"rule_id":"osv/GHSA-gx76-c99x-2c96","severity":"low","message":"aiohttp@3.14.3 (PyPI) is affected by GHSA-gx76-c99x-2c96; also in backend/requirements.txt","path":"backend/requirements-dev.txt","line":null,"fingerprint":"aiohttp@3.14.3 (PyPI):GHSA-gx76-c99x-2c96"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.2.2 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"frontend/package-lock.json","line":null,"fingerprint":"vite@8.2.2 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":24.0,"findings_high":14.0,"findings_medium":1.0,"findings_low":9.0,"penalty":171.3},"findings":[{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/cut-release.yml","line":32,"fingerprint":"template-injection:.github/workflows/cut-release.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/cut-release.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/cut-release.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/develop.yml","line":14,"fingerprint":"unpinned-uses:.github/workflows/develop.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/develop.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/develop.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/develop.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/develop.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/develop.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/develop.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/develop.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/develop.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/release.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/release.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/release.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/release.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":41,"fingerprint":"unpinned-uses:.github/workflows/release.yml:41"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":49,"fingerprint":"unpinned-uses:.github/workflows/release.yml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":65,"fingerprint":"unpinned-uses:.github/workflows/release.yml:65"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/develop.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/develop.yml:9"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/cut-release.yml","line":23,"fingerprint":"artipacked:.github/workflows/cut-release.yml:23"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/develop.yml","line":13,"fingerprint":"artipacked:.github/workflows/develop.yml:13"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":18,"fingerprint":"artipacked:.github/workflows/release.yml:18"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/cut-release.yml","line":50,"fingerprint":"template-injection:.github/workflows/cut-release.yml:50"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/cut-release.yml","line":50,"fingerprint":"template-injection:.github/workflows/cut-release.yml:50"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/cut-release.yml","line":51,"fingerprint":"template-injection:.github/workflows/cut-release.yml:51"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/cut-release.yml","line":59,"fingerprint":"template-injection:.github/workflows/cut-release.yml:59"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/cut-release.yml","line":64,"fingerprint":"template-injection:.github/workflows/cut-release.yml:64"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":65,"fingerprint":"superfluous-actions:.github/workflows/release.yml:65"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":1.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1345.0,"function_nloc":18970.0,"mean_ccn":3.35,"p90_ccn":7.0,"complex_functions":36.0,"long_functions":22.0,"many_param_functions":4.0,"risky_nloc_share":0.3262},"findings":[],"evidence":[{"kind":"complex-function","description":"test_connection in backend/app/api/settings.py: complexity 118, 472 lines","ref":"backend/app/api/settings.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/api/settings.py#L284","weight":1.0},{"kind":"complex-function","description":"NotificationsSettings in frontend/src/components/settings/NotificationsSettings.tsx: complexity 67, 402 lines","ref":"frontend/src/components/settings/NotificationsSettings.tsx","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/frontend/src/components/settings/NotificationsSettings.tsx#L64","weight":1.0},{"kind":"complex-function","description":"_download_poll_cycle in backend/app/services/polling_monitor.py: complexity 51, 199 lines","ref":"backend/app/services/polling_monitor.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/services/polling_monitor.py#L872","weight":0.85},{"kind":"complex-function","description":"discover_interfaces in backend/app/services/snmp_monitor.py: complexity 43, 131 lines","ref":"backend/app/services/snmp_monitor.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/services/snmp_monitor.py#L551","weight":0.7166666666666667},{"kind":"complex-function","description":"NotificationsStep in frontend/src/components/wizard/steps/NotificationsStep.tsx: complexity 41, 304 lines","ref":"frontend/src/components/wizard/steps/NotificationsStep.tsx","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/frontend/src/components/wizard/steps/NotificationsStep.tsx#L74","weight":0.6833333333333333},{"kind":"complex-function","description":"_plex_poll_cycle in backend/app/services/polling_monitor.py: complexity 37, 88 lines","ref":"backend/app/services/polling_monitor.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/services/polling_monitor.py#L649","weight":0.6166666666666667},{"kind":"complex-function","description":"(anonymous) in frontend/src/components/wizard/WizardContext.tsx: complexity 37, 132 lines","ref":"frontend/src/components/wizard/WizardContext.tsx","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/frontend/src/components/wizard/WizardContext.tsx#L180","weight":0.6166666666666667},{"kind":"complex-function","description":"BandwidthChart in frontend/src/components/BandwidthChart.tsx: complexity 35, 302 lines","ref":"frontend/src/components/BandwidthChart.tsx","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/frontend/src/components/BandwidthChart.tsx#L165","weight":0.5833333333333334},{"kind":"complex-function","description":"get_current_status in backend/app/api/status.py: complexity 34, 143 lines","ref":"backend/app/api/status.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/api/status.py#L17","weight":0.5666666666666667},{"kind":"complex-function","description":"DownloadClientCard in frontend/src/components/settings/DownloadClientsSettings.tsx: complexity 32, 139 lines","ref":"frontend/src/components/settings/DownloadClientsSettings.tsx","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/frontend/src/components/settings/DownloadClientsSettings.tsx#L112","weight":0.5333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":22755.0,"duplicated_lines":2402.0,"duplicated_share":0.1056,"files":151.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/api/bandwidth.py:154 and backend/app/api/bandwidth.py:166","ref":"backend/app/api/bandwidth.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/api/bandwidth.py#L154","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/api/settings.py:455 and backend/app/api/settings.py:498","ref":"backend/app/api/settings.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/api/settings.py#L455","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/api/settings.py:966 and backend/app/main.py:212","ref":"backend/app/api/settings.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/api/settings.py#L966","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/api/status.py:66 and backend/app/services/decision_engine.py:283","ref":"backend/app/api/status.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/api/status.py#L66","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/clients/base.py:18 and backend/app/clients/qbittorrent.py:19","ref":"backend/app/clients/base.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/clients/base.py#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/clients/deluge.py:137 and backend/app/clients/qbittorrent.py:36","ref":"backend/app/clients/deluge.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/clients/deluge.py#L137","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/clients/deluge.py:163 and backend/app/clients/transmission.py:93","ref":"backend/app/clients/deluge.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/clients/deluge.py#L163","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/clients/plex.py:35 and backend/app/clients/qbittorrent.py:29","ref":"backend/app/clients/plex.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/clients/plex.py#L35","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/clients/qbittorrent.py:115 and backend/app/clients/transmission.py:104","ref":"backend/app/clients/qbittorrent.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/clients/qbittorrent.py#L115","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: backend/app/models/bandwidth.py:76 and backend/app/models/bandwidth.py:100","ref":"backend/app/models/bandwidth.py","url":"https://github.com/speedarr/Speedarr/blob/9dc6c14600747ebcbdbc53460faabae33dbd52b2/backend/app/models/bandwidth.py#L76","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":105.0,"weighted_findings":105.25,"scanned_lines":30224.0,"category:best-practice":79.0,"category:correctness":5.0,"category:maintainability":21.0},"findings":[{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `restore_client_with_retry` is defined inside a function but never used","path":"backend/app/services/controller_manager.py","line":229,"fingerprint":"python.lang.maintainability.useless-inner-function:backend/app/services/controller_manager.py:229"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `remove_client_with_retry` is defined inside a function but never used","path":"backend/app/services/controller_manager.py","line":264,"fingerprint":"python.lang.maintainability.useless-inner-function:backend/app/services/controller_manager.py:264"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_active\" a function or an attribute? If it is a function, you may have meant user.is_active() because user.is_active is always true.","path":"backend/app/api/auth.py","line":175,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/api/auth.py:175"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_active\" a function or an attribute? If it is a function, you may have meant user.is_active() because user.is_active is always true.","path":"backend/app/api/auth.py","line":221,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/api/auth.py:221"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_active\" a function or an attribute? If it is a function, you may have meant APIToken.is_active() because APIToken.is_active is always true.","path":"backend/app/api/auth.py","line":230,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/api/auth.py:230"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_active\" a function or an attribute? If it is a function, you may have meant user.is_active() because user.is_active is always true.","path":"backend/app/api/auth.py","line":247,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/api/auth.py:247"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_active\" a function or an attribute? If it is a function, you may have meant t.is_active() because t.is_active is always true.","path":"backend/app/api/auth.py","line":375,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/api/auth.py:375"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_active\" a function or an attribute? If it is a function, you may have meant api_token.is_active() because api_token.is_active is always true.","path":"backend/app/api/auth.py","line":437,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/api/auth.py:437"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_throttled\" a function or an attribute? If it is a function, you may have meant m.is_throttled() because m.is_throttled is always true.","path":"backend/app/api/bandwidth.py","line":148,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/api/bandwidth.py:148"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/api/settings.py","line":1004,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/api/settings.py:1004"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/api/settings.py","line":1414,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/api/settings.py:1414"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/api/settings.py","line":1567,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/api/settings.py:1567"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/deluge.py","line":134,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/deluge.py:134"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/deluge.py","line":224,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/deluge.py:224"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/nzbget.py","line":119,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/nzbget.py:119"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/qbittorrent.py","line":73,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/qbittorrent.py:73"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/qbittorrent.py","line":165,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/qbittorrent.py:165"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/sabnzbd.py","line":108,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/sabnzbd.py:108"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/sabnzbd.py","line":126,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/sabnzbd.py:126"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/sabnzbd.py","line":147,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/sabnzbd.py:147"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/clients/transmission.py","line":155,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/clients/transmission.py:155"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/app/config.py","line":30,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/app/config.py:30"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/app/config.py","line":221,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/app/config.py:221"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/app/config.py","line":234,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/app/config.py:234"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/app/config.py","line":245,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/app/config.py:245"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/app/config.py","line":257,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/app/config.py:257"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/app/config.py","line":269,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/app/config.py:269"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"backend/app/config.py","line":437,"fingerprint":"python.lang.maintainability.return-not-in-function:backend/app/config.py:437"},{"rule_id":"opengrep/python.lang.maintainability.useless-if-body","severity":"medium","message":"Useless if statement; both blocks have the same body","path":"backend/app/config.py","line":632,"fingerprint":"python.lang.maintainability.useless-if-body:backend/app/config.py:632"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/database.py","line":208,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/database.py:208"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/services/config_manager.py","line":231,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/services/config_manager.py:231"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/services/retention_service.py","line":62,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/services/retention_service.py:62"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/services/retention_service.py","line":79,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/services/retention_service.py:79"},{"rule_id":"opengrep/python.lang.best-practice.logging-error-without-handling","severity":"medium","message":"Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.","path":"backend/app/services/retention_service.py","line":95,"fingerprint":"python.lang.best-practice.logging-error-without-handling:backend/app/services/retention_service.py:95"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_up\" a function or an attribute? If it is a function, you may have meant iface.is_up() because iface.is_up is always true.","path":"backend/app/services/snmp_monitor.py","line":762,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/services/snmp_monitor.py:762"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_private\" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(ip).is_private() because ipaddress.ip_address(ip).is_private is always true.","path":"backend/app/utils/network.py","line":11,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/utils/network.py:11"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_loopback\" a function or an attribute? If it is a function, you may have meant addr.is_loopback() because addr.is_loopback is always true.","path":"backend/app/utils/network.py","line":47,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/utils/network.py:47"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_link_local\" a function or an attribute? If it is a function, you may have meant addr.is_link_local() because addr.is_link_local is always true.","path":"backend/app/utils/network.py","line":47,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:backend/app/utils/network.py:47"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ErrorBoundary.tsx","line":82,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ErrorBoundary.tsx:82"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/settings/MediaServerSettings.tsx","line":67,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/settings/MediaServerSettings.tsx:67"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":24,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:24"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":42,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:42"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":57,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:57"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":71,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:71"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":83,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:83"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":95,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:95"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":108,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:108"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert-dialog.tsx","line":124,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert-dialog.tsx:124"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert.tsx","line":30,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert.tsx:30"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert.tsx","line":42,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert.tsx:42"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/alert.tsx","line":54,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/alert.tsx:54"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/badge.tsx","line":32,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/badge.tsx:32"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/button.tsx","line":49,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/button.tsx:49"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/card.tsx","line":15,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/card.tsx:15"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/card.tsx","line":27,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/card.tsx:27"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/card.tsx","line":42,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/card.tsx:42"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/card.tsx","line":54,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/card.tsx:54"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/card.tsx","line":63,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/card.tsx:63"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/card.tsx","line":74,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/card.tsx:74"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/checkbox.tsx","line":19,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/checkbox.tsx:19"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dialog.tsx","line":25,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dialog.tsx:25"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dialog.tsx","line":42,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dialog.tsx:42"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dialog.tsx","line":63,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dialog.tsx:63"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dialog.tsx","line":77,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dialog.tsx:77"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dialog.tsx","line":92,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dialog.tsx:92"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dialog.tsx","line":104,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dialog.tsx:104"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":32,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:32"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":51,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:51"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":69,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:69"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":88,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:88"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":104,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:104"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":127,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:127"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":152,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:152"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":164,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:164"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/dropdown-menu.tsx","line":176,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/dropdown-menu.tsx:176"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/input.tsx","line":18,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/input.tsx:18"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/label.tsx","line":19,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/label.tsx:19"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/select.tsx","line":23,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/select.tsx:23"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/select.tsx","line":43,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/select.tsx:43"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/select.tsx","line":60,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/select.tsx:60"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/select.tsx","line":82,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/select.tsx:82"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/select.tsx","line":107,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/select.tsx:107"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/select.tsx","line":122,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/select.tsx:122"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/select.tsx","line":142,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/select.tsx:142"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/switch.tsx","line":15,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/switch.tsx:15"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":13,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:13"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":23,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:23"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":34,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:34"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":49,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:49"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":64,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:64"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":80,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:80"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":92,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:92"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/table.tsx","line":104,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/table.tsx:104"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/tabs.tsx","line":18,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/tabs.tsx:18"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/tabs.tsx","line":33,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/tabs.tsx:33"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/ui/tabs.tsx","line":48,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/ui/tabs.tsx:48"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/wizard/steps/BandwidthStep.tsx","line":33,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/wizard/steps/BandwidthStep.tsx:33"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/wizard/steps/DownloadClientsStep.tsx","line":82,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/wizard/steps/DownloadClientsStep.tsx:82"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/wizard/steps/MediaServerStep.tsx","line":36,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/wizard/steps/MediaServerStep.tsx:36"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/wizard/steps/NotificationsStep.tsx","line":75,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/wizard/steps/NotificationsStep.tsx:75"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/components/ThrottlingBanner.tsx","line":17,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/components/ThrottlingBanner.tsx:17"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/components/ThrottlingBanner.tsx","line":17,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/components/ThrottlingBanner.tsx:17"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/components/settings/APIKeysSettings.tsx","line":191,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/components/settings/APIKeysSettings.tsx:191"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/components/settings/ThrottlingControl.tsx","line":30,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/components/settings/ThrottlingControl.tsx:30"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/components/settings/ThrottlingControl.tsx","line":30,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/components/settings/ThrottlingControl.tsx:30"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.3436,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":5193.0,"source_lines":30224.0,"test_ratio":0.1718,"ci_files":3.0,"cochange_share":0.4167,"cochange_commits":168.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/cut-release.yml","ref":".github/workflows/cut-release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/develop.yml","ref":".github/workflows/develop.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":110.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.5721,"check:low_escape_density":1.0,"escapes":145.0,"escapes_per_kloc":4.819},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: frontend/tsconfig.json","ref":"frontend/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":213.0,"other_lines":30011.0,"files_blamed":151.0,"blame_failures":0.0,"quality:ai_findings":1.0,"quality:ai_per_kloc":4.695,"quality:other_findings":104.0,"quality:other_per_kloc":3.465,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":7.0,"security:other_per_kloc":0.233},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}