{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:08.271619Z","repo":{"ref":{"host":"github.com","owner":"varun-ml","name":"buddy"},"default_branch":"main","clone_url":"https://github.com/varun-ml/buddy.git","html_url":"https://github.com/varun-ml/buddy","description":"A little pet on your Mac that tells you when Claude Code or Codex needs you. 100% local.","stars":11,"forks":2,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2662,"primary_language":"Swift","license_spdx":"MIT","created_at":"2026-10-07T06:21:07Z","pushed_at":"2026-11-02T05:42:43Z","security_policy_url":"https://github.com/varun-ml/buddy/security/policy","distribution":{"owner_created_at":"2014-04-14T05:54:30Z","owner_type":"User","release_assets":[]}},"commit_sha":"24a42083e475676a74ef0611c91e151201d96d25","profile":{"lines_by_language":{"Swift":8146,"Kotlin":1311,"Python":999,"Shell":156},"files_by_category":{"source":51,"binary":10,"docs":9,"other":6,"config":6,"test":2,"oversized":1},"source_lines":10397,"test_lines":215},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.87,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":0.0,"style_index":6.685},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":56.3,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":33.8,"duplication":98.3,"lint":57.5,"testing":42.3,"docs":80.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.02, no CI test run detected; 36% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity."},"security":{"score":85.9,"confidence":0.85,"coverage":1.0,"label":"strong","breakdown":{"secrets":100.0,"sast":74.9,"dependencies":null,"ci_actions":94.2,"posture":60.0,"scorecard":null},"summary":"Security posture is strong: 7 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":68.0,"attributed_commits":68.0,"attributed_commit_share":1.0,"effective_loc":15819.0,"attributed_loc":15819.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 68 attributed commits, 15,819 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"24a42083e475676a74ef0611c91e151201d96d25","url":"https://github.com/varun-ml/buddy/commit/24a42083e475676a74ef0611c91e151201d96d25","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"1539cf385ea8b4d4187167bf571982d64a8713fb","url":"https://github.com/varun-ml/buddy/commit/1539cf385ea8b4d4187167bf571982d64a8713fb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"f85ab0141b2363ba89e34592b3a10f1521a72fd9","url":"https://github.com/varun-ml/buddy/commit/f85ab0141b2363ba89e34592b3a10f1521a72fd9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"eb75dca2a67c864aa069f94cf908aed09e183278","url":"https://github.com/varun-ml/buddy/commit/eb75dca2a67c864aa069f94cf908aed09e183278","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"437d2c3667aafb910909fa6787ba545154e556ff","url":"https://github.com/varun-ml/buddy/commit/437d2c3667aafb910909fa6787ba545154e556ff","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"ffd16c3f0d6fa794a2b6d0bfd83089508b9041c0","url":"https://github.com/varun-ml/buddy/commit/ffd16c3f0d6fa794a2b6d0bfd83089508b9041c0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"deb2f853a516ea4463ea99ae26a40ea66e6dc17b","url":"https://github.com/varun-ml/buddy/commit/deb2f853a516ea4463ea99ae26a40ea66e6dc17b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"72f6fef7bad6c62641e680cfd999e8513e2e7334","url":"https://github.com/varun-ml/buddy/commit/72f6fef7bad6c62641e680cfd999e8513e2e7334","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"b34fd979f6e5b3f8896f61bbc6611e6e829dc4e4","url":"https://github.com/varun-ml/buddy/commit/b34fd979f6e5b3f8896f61bbc6611e6e829dc4e4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"101f10a7c62e6796780d143439e85bdff852a40e","url":"https://github.com/varun-ml/buddy/commit/101f10a7c62e6796780d143439e85bdff852a40e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"ea893f6e6006531ec84b3e60f66719a496a48242","url":"https://github.com/varun-ml/buddy/commit/ea893f6e6006531ec84b3e60f66719a496a48242","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"2c1b4763bd800bdc5897e09facdb79af8f46ca69","url":"https://github.com/varun-ml/buddy/commit/2c1b4763bd800bdc5897e09facdb79af8f46ca69","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9ae54330c5178391bdfcfb3ccb5c5676909723fe","url":"https://github.com/varun-ml/buddy/commit/9ae54330c5178391bdfcfb3ccb5c5676909723fe","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"271f60060076ab24242974a518608c90c896ab6a","url":"https://github.com/varun-ml/buddy/commit/271f60060076ab24242974a518608c90c896ab6a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"dd9fd8a4d09e9748b01016bba7965346f2677636","url":"https://github.com/varun-ml/buddy/commit/dd9fd8a4d09e9748b01016bba7965346f2677636","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"de0645ab189af1fde8d85ef73f202444e03ec295","url":"https://github.com/varun-ml/buddy/commit/de0645ab189af1fde8d85ef73f202444e03ec295","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"093a169761fa4e6294a5e86c52981fcc2990dd03","url":"https://github.com/varun-ml/buddy/commit/093a169761fa4e6294a5e86c52981fcc2990dd03","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"73e169f73d5b79ee5d037cf05a83802a92a71681","url":"https://github.com/varun-ml/buddy/commit/73e169f73d5b79ee5d037cf05a83802a92a71681","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"15316b76726ee8aafc29cbecc5c8d7affa8ceeb6","url":"https://github.com/varun-ml/buddy/commit/15316b76726ee8aafc29cbecc5c8d7affa8ceeb6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"cc2824ba03da57688276d2203108da118fd7c60e","url":"https://github.com/varun-ml/buddy/commit/cc2824ba03da57688276d2203108da118fd7c60e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"e94725b0b7910d99108130b81f5d8fda2c869bee","url":"https://github.com/varun-ml/buddy/commit/e94725b0b7910d99108130b81f5d8fda2c869bee","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"8f0a0ca2924eb2ba43ab1ad38b5f54fb131c9c5f","url":"https://github.com/varun-ml/buddy/commit/8f0a0ca2924eb2ba43ab1ad38b5f54fb131c9c5f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"e207de921d11429be12f057a420946100021c457","url":"https://github.com/varun-ml/buddy/commit/e207de921d11429be12f057a420946100021c457","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"5ebc1a70f2af4eb0c9bc55a9321c8d85c185f3be","url":"https://github.com/varun-ml/buddy/commit/5ebc1a70f2af4eb0c9bc55a9321c8d85c185f3be","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"a793f640a848b104271ecd3c74a5414c226229c9","url":"https://github.com/varun-ml/buddy/commit/a793f640a848b104271ecd3c74a5414c226229c9","weight":0.9}],"data":{"attributed_loc_by_commit":{"d38d2177af8769b75b5205fdeb92b8dba7ee13b8":4321,"e015ebc97d0781bb56181f20d323aa8e3ea11790":51,"a4ceac66544cea0f93868db5a0ee27f982330aad":4031,"80855daa1a57ef1b127fdc3d851124028adc37d2":90,"9c0f1997568217207161f5968bbc6e8bbef89387":56,"780d577bec3aa078a78df37ac332b09ea6f15154":0,"23ab2e1047f32d8830f9e02eff9d5ede92059889":55,"40c3163cbeab6c9c926af5ae626c90e0c9850c4a":2,"1f33d147b6e9d1924c6686d10d5f74c111c93ab5":201,"9609a940bd19fae6ceb7808842ab20c2838dde39":26,"0836ae77fb8d415235d11392d41784d5b35137b5":301,"7c6df935a80aa9c32a8a51ae0a891c50de17c1c7":0,"51a04408fb1563de4c969e44021b7fd818d41ab6":75,"9168b16d92ae60ff89a83cabf8e217d77a9edf98":0,"29e50775e3fd3e929eb8b21bc32cf0d3c2c5583b":183,"5e9b23440cf1a8ef1d463c9d261c73a93571d1b6":266,"4ea99d84f7e39c58a66f40f84ad93f3f649edd28":805,"e964cc04558c22ca8c6f8b5126ab63c7ea912177":31,"178819d360a7632c056078c85450f7b2e58ccb0f":0,"b0ecb578550ec38e58db2f7bf6fbe2c8e0f21e7a":212,"0b3994c8441656bcce30e7e86d245925ddbc7be0":17,"7c51591cef296a69d42d03f5860981cd9a6f6c84":11,"a4a79f7720f74c28e6c65087e8b18bf38e27450b":41,"3cf97b085c0cce5e19a86a0eebbebc626569ccb0":1,"f71978b096e06dfe75e65ba27c881a78cfd7e9db":187,"38db98e23ba4e90f59c92913406fce701cb890a1":27,"1b855ffe40d7c8194e432846ca16ff8338f86682":86,"ef0755f230f4af36ff333ad3e2f8e0c6b77d4522":13,"67aa1dcd8be01702a9ff50f7e4cf8cf0b00c12bf":105,"2b0b216b958d73941a5c4075b1874f3fcc888979":1,"7cf4258ad87651152f7012e8b82a554986ba6333":3,"40725d53f4761c2d6142c8df72d7dfb818d87b06":11,"d8a6f08f228515d8023854fcb9136ffadcc6045d":28,"6a91abeef6ba6a0918498c53d34f9e97cf52299d":12,"07acd5416a304cb836d6b76f74a8ad4a2f3abbce":69,"6c1fb20d529a27ba8fa896f168c1f1dd11a1432c":21,"12894b63cbebfce6985b77ead339cdcecc36710a":13,"f12ca7c654c9826480846f89d5de042b6a75e213":0,"60671fe8ac2360f6cc0697ff1d910dc8aad0ed55":21,"ce5ca1e8be84f1933b2ed1724bf9bd01f417772b":1705,"6cb0469d123dd5fa3be3a0bda81c912f6951e4ae":26,"3ee7e01ba1771074b76bc2cefb338799a5585263":171,"09b0298f2c44d3c16449584d705cb71e93261d6f":10,"a793f640a848b104271ecd3c74a5414c226229c9":43,"5ebc1a70f2af4eb0c9bc55a9321c8d85c185f3be":12,"e207de921d11429be12f057a420946100021c457":28,"8f0a0ca2924eb2ba43ab1ad38b5f54fb131c9c5f":83,"e94725b0b7910d99108130b81f5d8fda2c869bee":20,"cc2824ba03da57688276d2203108da118fd7c60e":55,"15316b76726ee8aafc29cbecc5c8d7affa8ceeb6":165,"73e169f73d5b79ee5d037cf05a83802a92a71681":78,"093a169761fa4e6294a5e86c52981fcc2990dd03":6,"de0645ab189af1fde8d85ef73f202444e03ec295":20,"dd9fd8a4d09e9748b01016bba7965346f2677636":17,"271f60060076ab24242974a518608c90c896ab6a":65,"9ae54330c5178391bdfcfb3ccb5c5676909723fe":99,"2c1b4763bd800bdc5897e09facdb79af8f46ca69":72,"ea893f6e6006531ec84b3e60f66719a496a48242":4,"101f10a7c62e6796780d143439e85bdff852a40e":84,"b34fd979f6e5b3f8896f61bbc6611e6e829dc4e4":42,"72f6fef7bad6c62641e680cfd999e8513e2e7334":228,"deb2f853a516ea4463ea99ae26a40ea66e6dc17b":47,"ffd16c3f0d6fa794a2b6d0bfd83089508b9041c0":4,"437d2c3667aafb910909fa6787ba545154e556ff":350,"eb75dca2a67c864aa069f94cf908aed09e183278":5,"f85ab0141b2363ba89e34592b3a10f1521a72fd9":850,"1539cf385ea8b4d4187167bf571982d64a8713fb":9,"24a42083e475676a74ef0611c91e151201d96d25":148},"tools":{"claude-code":{"name":"Claude Code","commits":68,"loc":15819,"first_seen":1791354063,"last_seen":1793598162}},"monthly":{"2026-10":{"loc":15671,"attributed_loc":15671},"2026-11":{"loc":148,"attributed_loc":148}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":55.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":7467.0,"flagged_loc":1705.0,"flagged_loc_share":0.2283380206240793,"max_loc_per_hour":1654.8935022917228,"median_loc_per_hour":49.43325344905758,"pr_timed_units":52.0,"excluded_import_loc":8352.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,705 lines of first-party code in ~1.0h (1,655 lines/hour, PR #29)","ref":"ce5ca1e8be84f1933b2ed1724bf9bd01f417772b","url":"https://github.com/varun-ml/buddy/commit/ce5ca1e8be84f1933b2ed1724bf9bd01f417772b","weight":0.4964680506875168}],"data":{"flagged_loc_by_commit":{"ce5ca1e8be84f1933b2ed1724bf9bd01f417772b":1705},"excluded_import_commits":["a4ceac66544cea0f93868db5a0ee27f982330aad","d38d2177af8769b75b5205fdeb92b8dba7ee13b8"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":4.0,"flagged_releases":0.0,"max_loc_per_day":1367.2},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0.0","to":"v1.0.1","loc":4,"days":0.04,"loc_per_day":96.0,"flagged":false},{"from":"v1.0.1","to":"v1.0.2","loc":354,"days":0.26,"loc_per_day":1367.2,"flagged":false},{"from":"v1.0.2","to":"v1.0.3","loc":401,"days":2.7,"loc_per_day":148.7,"flagged":false},{"from":"v1.0.3","to":"v1.1.0","loc":864,"days":4.4,"loc_per_day":196.3,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":10397.0,"index":6.685,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":139.0,"per_kloc:emoji_in_code":13.369,"files:emoji_in_code":26.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"findings_high":7.0,"findings_medium":5.0,"findings_low":0.0,"weighted_findings":8.6,"scanned_lines":10397.0,"parse_errors":5.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"beat.py","line":133,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:beat.py:133"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"beat.py","line":147,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:beat.py:147"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"beat.py","line":147,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:beat.py:147"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"beat.py","line":349,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:beat.py:349"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"beat.py","line":349,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:beat.py:349"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"buddy-cli","line":22,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:buddy-cli:22"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"phone.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:phone.py:39"},{"rule_id":"opengrep/swift.lang.crypto.insecure-random","severity":"medium","message":"A random number generator was detected which is **not** *guaranteed* to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the `SecCopyRandomBytes` API explicitly. [confidence low]","path":"Sources/Model.swift","line":521,"fingerprint":"swift.lang.crypto.insecure-random:Sources/Model.swift:521"},{"rule_id":"opengrep/swift.lang.crypto.insecure-random","severity":"medium","message":"A random number generator was detected which is **not** *guaranteed* to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the `SecCopyRandomBytes` API explicitly. [confidence low]","path":"Sources/Model.swift","line":529,"fingerprint":"swift.lang.crypto.insecure-random:Sources/Model.swift:529"},{"rule_id":"opengrep/swift.lang.crypto.insecure-random","severity":"medium","message":"A random number generator was detected which is **not** *guaranteed* to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the `SecCopyRandomBytes` API explicitly. [confidence low]","path":"Sources/Window.swift","line":497,"fingerprint":"swift.lang.crypto.insecure-random:Sources/Window.swift:497"},{"rule_id":"opengrep/swift.lang.crypto.insecure-random","severity":"medium","message":"A random number generator was detected which is **not** *guaranteed* to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the `SecCopyRandomBytes` API explicitly. [confidence low]","path":"Sources/Window.swift","line":535,"fingerprint":"swift.lang.crypto.insecure-random:Sources/Window.swift:535"},{"rule_id":"opengrep/swift.lang.crypto.insecure-random","severity":"medium","message":"A random number generator was detected which is **not** *guaranteed* to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the `SecCopyRandomBytes` API explicitly. [confidence low]","path":"Sources/Window.swift","line":547,"fingerprint":"swift.lang.crypto.insecure-random:Sources/Window.swift:547"}],"evidence":[],"data":{"rulesets":["swift","kotlin","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":2.0,"findings_high":0.0,"findings_medium":2.0,"findings_low":0.0,"penalty":3.6},"findings":[{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":8,"fingerprint":"artipacked:.github/workflows/ci.yml:8"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":5,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:5"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.7941,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":682.0,"function_nloc":7279.0,"mean_ccn":4.85,"p90_ccn":11.0,"complex_functions":45.0,"long_functions":9.0,"many_param_functions":1.0,"risky_nloc_share":0.3613},"findings":[],"evidence":[{"kind":"complex-function","description":"body in Sources/Pet.swift: complexity 133, 152 lines","ref":"Sources/Pet.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/Pet.swift#L163","weight":1.0},{"kind":"complex-function","description":"wander in Sources/Window.swift: complexity 60, 80 lines","ref":"Sources/Window.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/Window.swift#L468","weight":1.0},{"kind":"complex-function","description":"ninjaAvatar in Sources/BuddyNinja.swift: complexity 53, 117 lines","ref":"Sources/BuddyNinja.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/BuddyNinja.swift#L59","weight":0.8833333333333333},{"kind":"complex-function","description":"lifeNudge in Sources/Life.swift: complexity 49, 62 lines","ref":"Sources/Life.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/Life.swift#L312","weight":0.8166666666666667},{"kind":"complex-function","description":"robotAvatar in Sources/BuddyRobot.swift: complexity 45, 83 lines","ref":"Sources/BuddyRobot.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/BuddyRobot.swift#L42","weight":0.75},{"kind":"complex-function","description":"wizardAvatar in Sources/BuddyWizard.swift: complexity 43, 121 lines","ref":"Sources/BuddyWizard.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/BuddyWizard.swift#L41","weight":0.7166666666666667},{"kind":"complex-function","description":"googleSelftest in Sources/GoogleSelftest.swift: complexity 41, 108 lines","ref":"Sources/GoogleSelftest.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/GoogleSelftest.swift#L5","weight":0.6833333333333333},{"kind":"complex-function","description":"say in Sources/Model.swift: complexity 41, 27 lines","ref":"Sources/Model.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/Model.swift#L331","weight":0.6833333333333333},{"kind":"complex-function","description":"main in beat.py: complexity 39, 73 lines","ref":"beat.py","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/beat.py#L276","weight":0.65},{"kind":"complex-function","description":"chemistAvatar in Sources/BuddyChemist.swift: complexity 35, 111 lines","ref":"Sources/BuddyChemist.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/BuddyChemist.swift#L44","weight":0.5833333333333334}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":8215.0,"duplicated_lines":24.0,"duplicated_share":0.0029,"files":51.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: Sources/Glass.swift:138 and Sources/Ink.swift:159","ref":"Sources/Glass.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/Glass.swift#L138","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Sources/main.swift:254 and Sources/main.swift:274","ref":"Sources/main.swift","url":"https://github.com/varun-ml/buddy/blob/24a42083e475676a74ef0611c91e151201d96d25/Sources/main.swift#L254","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":21.0,"weighted_findings":23.0,"scanned_lines":10397.0,"category:best-practice":21.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"phone.py","line":271,"fingerprint":"python.lang.best-practice.arbitrary-sleep:phone.py:271"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":106,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:106"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":161,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:161"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":165,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:165"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":226,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:226"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":233,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:233"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":300,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:300"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":345,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:345"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":364,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:364"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":383,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:383"},{"rule_id":"opengrep/python.lang.best-practice.hardcoded-tmp-path","severity":"medium","message":"Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.","path":"beat.py","line":396,"fingerprint":"python.lang.best-practice.hardcoded-tmp-path:beat.py:396"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"beat.py","line":396,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:beat.py:396"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":31,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:31"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":33,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:33"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":139,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:139"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":156,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:156"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":169,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:169"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":219,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:219"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":268,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:268"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":281,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:281"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phone.py","line":336,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phone.py:336"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0414,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.625,"test_lines":215.0,"source_lines":10397.0,"test_ratio":0.0207,"ci_files":1.0,"cochange_share":0.1562,"cochange_commits":64.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":166.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":10397.0,"other_lines":0.0,"files_blamed":51.0,"blame_failures":0.0,"quality:ai_findings":21.0,"quality:ai_per_kloc":2.02,"quality:other_findings":0.0,"security:ai_findings":11.0,"security:ai_per_kloc":1.058,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}