{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:08.645964Z","repo":{"ref":{"host":"github.com","owner":"ybizeul","name":"timeline"},"default_branch":"main","clone_url":"https://github.com/ybizeul/timeline.git","html_url":"https://github.com/ybizeul/timeline","description":"A simple browser based timeline builder","stars":7,"forks":2,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":478,"primary_language":"JavaScript","license_spdx":null,"created_at":"2026-03-28T20:47:32Z","pushed_at":"2026-07-22T05:14:35Z","security_policy_url":null,"distribution":{"owner_created_at":"2010-01-14T08:50:07Z","owner_type":"User","release_assets":[]}},"commit_sha":"ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3","profile":{"lines_by_language":{"JavaScript":8739,"Go":1772},"files_by_category":{"source":53,"other":18,"config":14,"docs":3,"binary":3,"generated":2},"source_lines":10511,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.64,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.1747,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":0.0,"style_index":0.19},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":49.4,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":54.8,"duplication":46.5,"lint":95.4,"testing":15.0,"docs":60.0,"type_safety":null,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 20% of function code in complex or long functions; 13% duplicated lines. Weakest area: testing."},"security":{"score":47.9,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":58.7,"dependencies":20.5,"ci_actions":15.0,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 61 known vulnerabilities in 15 dependencies; 2 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":15.0,"checked":15.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":94.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":12373.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-03":{"loc":3840,"attributed_loc":0},"2026-04":{"loc":7713,"attributed_loc":0},"2026-06":{"loc":814,"attributed_loc":0},"2026-07":{"loc":6,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":37.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":9364.0,"flagged_loc":2161.0,"flagged_loc_share":0.2307774455360957,"max_loc_per_hour":540.25,"median_loc_per_hour":54.7213456893836,"pr_timed_units":0.0,"excluded_import_loc":3009.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,161 lines of first-party code in ~4.0h (540 lines/hour, 1 commit session)","ref":"80b5c3f6949de069c28306d292539eef59da842c","url":"https://github.com/ybizeul/timeline/commit/80b5c3f6949de069c28306d292539eef59da842c","weight":0.162075}],"data":{"flagged_loc_by_commit":{"80b5c3f6949de069c28306d292539eef59da842c":2161},"excluded_import_commits":["6fae1bed598bcc7781deb4bdda5ad10c47f3c3da"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":5.0,"flagged_releases":0.0,"max_loc_per_day":4356.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.9.1","to":"v0.9.2","loc":68,"days":0.82,"loc_per_day":82.5,"flagged":false},{"from":"v0.9.2","to":"v0.9.3","loc":708,"days":0.16,"loc_per_day":4356.0,"flagged":false},{"from":"v0.9.3","to":"v0.9.4","loc":3989,"days":9.65,"loc_per_day":413.5,"flagged":false},{"from":"v0.9.4","to":"v0.9.5","loc":783,"days":2.02,"loc_per_day":388.0,"flagged":false},{"from":"v0.9.5","to":"v1.0","loc":666,"days":68.13,"loc_per_day":9.8,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":10511.0,"index":0.19,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":4.0,"per_kloc:emoji_in_code":0.381,"files:emoji_in_code":4.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":51.0,"findings_high":2.0,"findings_medium":48.0,"findings_low":1.0,"weighted_findings":16.012,"scanned_lines":10511.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":15,"fingerprint":"dockerfile.security.missing-user:Dockerfile:15"},{"rule_id":"opengrep/go.lang.security.filepath-clean-misuse","severity":"high","message":"`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the ser [confidence medium]","path":"server/internal/httpapi/router.go","line":116,"fingerprint":"go.lang.security.filepath-clean-misuse:server/internal/httpapi/router.go:116"},{"rule_id":"opengrep/go.gorilla.security.audit.session-cookie-missing-secure","severity":"medium","message":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct. [confidence medium]","path":"server/internal/auth/manager.go","line":46,"fingerprint":"go.gorilla.security.audit.session-cookie-missing-secure:server/internal/auth/manager.go:46"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":52,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:52"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":56,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:56"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":62,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:62"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":63,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:63"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":69,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:69"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":72,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:72"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":79,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:79"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":80,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:80"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":86,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:86"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":93,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:93"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":94,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:94"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":102,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:102"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":120,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:120"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":168,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:168"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":169,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:169"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":170,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:170"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":171,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:171"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":193,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:193"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":194,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:194"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportOrgChartSvg.js","line":207,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportOrgChartSvg.js:207"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":51,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:51"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":55,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:55"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":67,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:67"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":68,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:68"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":70,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:70"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":79,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:79"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":93,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:93"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":95,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:95"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":96,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:96"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":98,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:98"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":100,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:100"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":117,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:117"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":119,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:119"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":121,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:121"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":123,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:123"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":164,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:164"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":168,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:168"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":174,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:174"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":176,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:176"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":178,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:178"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":292,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:292"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":293,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:293"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":337,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:337"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":351,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:351"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":352,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:352"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":362,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:362"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/utils/exportSvg.js","line":363,"fingerprint":"javascript.lang.security.html-in-template-string:src/utils/exportSvg.js:363"},{"rule_id":"opengrep/javascript.browser.security.js-open-redirect-from-function","severity":"low","message":"The application accepts potentially user-controlled input `providerId` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input  [confidence low]","path":"src/App.jsx","line":580,"fingerprint":"javascript.browser.security.js-open-redirect-from-function:src/App.jsx:580"}],"evidence":[],"data":{"rulesets":["javascript","go","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":15.0,"vulnerabilities":61.0,"vulns_critical":7.0,"vulns_high":20.0,"vulns_medium":22.0,"vulns_low":2.0,"vulns_unknown":10.0,"penalty":95.0},"findings":[{"rule_id":"osv/GHSA-jppx-rxg9-jmrx","severity":"critical","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-jppx-rxg9-jmrx"},{"rule_id":"osv/GHSA-f5wc-c3c7-36mc","severity":"critical","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-f5wc-c3c7-36mc"},{"rule_id":"osv/GHSA-vgwf-h737-ff37","severity":"critical","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-vgwf-h737-ff37"},{"rule_id":"osv/GHSA-89gr-r52h-f8rx","severity":"critical","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-89gr-r52h-f8rx"},{"rule_id":"osv/GHSA-rm3j-f69w-wqmq","severity":"critical","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-rm3j-f69w-wqmq"},{"rule_id":"osv/GHSA-5cgq-3rg8-m6cv","severity":"critical","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-5cgq-3rg8-m6cv"},{"rule_id":"osv/GHSA-x527-x647-q7gg","severity":"critical","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-x527-x647-q7gg"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.13 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.13 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.13 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.13 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.13 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.13 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.13 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.13 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.13 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.13 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.8 (npm) is affected by GHSA-6g55-p6wh-862q","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.8 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@5.4.21 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-259r-337f-4rfw","severity":"high","message":"github.com/klauspost/compress@1.16.7 (Go) is affected by GO-2026-5841, GHSA-259r-337f-4rfw","path":"server/go.mod","line":null,"fingerprint":"github.com/klauspost/compress@1.16.7 (Go):GHSA-259r-337f-4rfw"},{"rule_id":"osv/GHSA-q4h4-gmj2-qvw2","severity":"high","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-q4h4-gmj2-qvw2"},{"rule_id":"osv/GHSA-w879-237q-wc7r","severity":"high","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-w879-237q-wc7r"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.7 (npm) is affected by GHSA-p498-v437-472g","path":"package-lock.json","line":null,"fingerprint":"@humanfs/node@0.16.7 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.10.12 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"package-lock.json","line":null,"fingerprint":"baseline-browser-mapping@2.10.12 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.13 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.13 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.21.5 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.21.5 (npm):GHSA-67mh-4wv8-2f99"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.1 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.8 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.8 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.8 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@5.4.21 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-mqqf-5wvp-8fh8","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-4316, GHSA-mqqf-5wvp-8fh8","path":"server/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GHSA-mqqf-5wvp-8fh8"},{"rule_id":"osv/GHSA-3fxj-6jh8-hvhx","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-5774, GHSA-3fxj-6jh8-hvhx","path":"server/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GHSA-3fxj-6jh8-hvhx"},{"rule_id":"osv/GO-2026-5775","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-5775","path":"server/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GO-2026-5775"},{"rule_id":"osv/GO-2026-5777","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GO-2026-5777","path":"server/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GO-2026-5777"},{"rule_id":"osv/GHSA-j6qf-3m9c-vwj3","severity":"medium","message":"github.com/go-chi/chi/v5@5.2.2 (Go) is affected by GHSA-j6qf-3m9c-vwj3","path":"server/go.mod","line":null,"fingerprint":"github.com/go-chi/chi/v5@5.2.2 (Go):GHSA-j6qf-3m9c-vwj3"},{"rule_id":"osv/GO-2026-6865","severity":"medium","message":"github.com/klauspost/compress@1.16.7 (Go) is affected by GO-2026-6865","path":"server/go.mod","line":null,"fingerprint":"github.com/klauspost/compress@1.16.7 (Go):GO-2026-6865"},{"rule_id":"osv/GO-2025-4116","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2025-4116","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GO-2025-4116"},{"rule_id":"osv/GHSA-j5w8-q4qc-rx2x","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2025-4134, GHSA-j5w8-q4qc-rx2x","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-j5w8-q4qc-rx2x"},{"rule_id":"osv/GHSA-f6x5-jh6r-wrfv","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2025-4135, GHSA-f6x5-jh6r-wrfv","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-f6x5-jh6r-wrfv"},{"rule_id":"osv/GHSA-45gg-vh54-h5m9","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-45gg-vh54-h5m9"},{"rule_id":"osv/GHSA-78mq-xcr3-xm33","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-78mq-xcr3-xm33"},{"rule_id":"osv/GHSA-qpw4-5x99-6vjp","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-qpw4-5x99-6vjp"},{"rule_id":"osv/GHSA-9m57-25v3-79x9","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GHSA-9m57-25v3-79x9"},{"rule_id":"osv/GO-2026-5932","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-5932","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GO-2026-5932"},{"rule_id":"osv/GO-2026-6303","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-6303","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GO-2026-6303"},{"rule_id":"osv/GO-2026-6354","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-6354","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GO-2026-6354"},{"rule_id":"osv/GO-2026-6355","severity":"medium","message":"golang.org/x/crypto@0.35.0 (Go) is affected by GO-2026-6355","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.35.0 (Go):GO-2026-6355"},{"rule_id":"osv/GO-2026-5970","severity":"medium","message":"golang.org/x/text@0.22.0 (Go) is affected by GO-2026-5970","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/text@0.22.0 (Go):GO-2026-5970"},{"rule_id":"osv/GO-2026-6629","severity":"medium","message":"golang.org/x/text@0.22.0 (Go) is affected by GO-2026-6629","path":"server/go.mod","line":null,"fingerprint":"golang.org/x/text@0.22.0 (Go):GO-2026-6629"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.29.0 (npm) is affected by GHSA-4x5r-pxfx-6jf8","path":"package-lock.json","line":null,"fingerprint":"@babel/core@7.29.0 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@5.4.21 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@5.4.21 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["Go","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":12.0,"findings_high":10.0,"findings_medium":2.0,"findings_low":0.0,"penalty":114.0},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:40"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/deploy.yml","line":28,"fingerprint":"cache-poisoning:.github/workflows/deploy.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:35"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":59,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:59"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/deploy.yml","line":25,"fingerprint":"artipacked:.github/workflows/deploy.yml:25"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docker.yml","line":29,"fingerprint":"artipacked:.github/workflows/docker.yml:29"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":944.0,"function_nloc":8567.0,"mean_ccn":2.72,"p90_ccn":6.0,"complex_functions":12.0,"long_functions":9.0,"many_param_functions":3.0,"risky_nloc_share":0.2007},"findings":[],"evidence":[{"kind":"complex-function","description":"App in src/App.jsx: complexity 47, 275 lines","ref":"src/App.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/App.jsx#L48","weight":0.7833333333333333},{"kind":"complex-function","description":"(anonymous) in src/App.jsx: complexity 42, 59 lines","ref":"src/App.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/App.jsx#L594","weight":0.7},{"kind":"complex-function","description":"exportTimelineSvg in src/utils/exportSvg.js: complexity 41, 135 lines","ref":"src/utils/exportSvg.js","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/utils/exportSvg.js#L219","weight":0.6833333333333333},{"kind":"complex-function","description":"computeWidth in src/utils/orgLayout.js: complexity 40, 136 lines","ref":"src/utils/orgLayout.js","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/utils/orgLayout.js#L125","weight":0.6666666666666666},{"kind":"complex-function","description":"parseOrgChartFile in src/utils/orgChartIo.js: complexity 37, 77 lines","ref":"src/utils/orgChartIo.js","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/utils/orgChartIo.js#L41","weight":0.6166666666666667},{"kind":"complex-function","description":"computeOrgLayout in src/utils/orgLayout.js: complexity 37, 110 lines","ref":"src/utils/orgLayout.js","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/utils/orgLayout.js#L24","weight":0.6166666666666667},{"kind":"complex-function","description":"onKey in src/components/OrgChart/OrgChart.jsx: complexity 21, 36 lines","ref":"src/components/OrgChart/OrgChart.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/components/OrgChart/OrgChart.jsx#L296","weight":0.35},{"kind":"complex-function","description":"PersonCard in src/components/OrgChart/PersonCard.jsx: complexity 19, 138 lines","ref":"src/components/OrgChart/PersonCard.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/components/OrgChart/PersonCard.jsx#L14","weight":0.31666666666666665},{"kind":"complex-function","description":"parseTimelineFile in src/utils/io.js: complexity 19, 36 lines","ref":"src/utils/io.js","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/utils/io.js#L52","weight":0.31666666666666665},{"kind":"complex-function","description":"buildOrgChartSvgString in src/utils/exportOrgChartSvg.js: complexity 18, 77 lines","ref":"src/utils/exportOrgChartSvg.js","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/utils/exportOrgChartSvg.js#L127","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":7867.0,"duplicated_lines":1003.0,"duplicated_share":0.1275,"files":53.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: server/internal/httpapi/private_routes.go:31 and server/internal/httpapi/private_routes.go:206","ref":"server/internal/httpapi/private_routes.go","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/server/internal/httpapi/private_routes.go#L31","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: server/internal/httpapi/share_routes.go:39 and server/internal/httpapi/share_routes.go:86","ref":"server/internal/httpapi/share_routes.go","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/server/internal/httpapi/share_routes.go#L39","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: server/internal/store/content.go:4 and server/internal/store/identity.go:4","ref":"server/internal/store/content.go","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/server/internal/store/content.go#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: server/internal/store/content.go:85 and server/internal/store/content.go:191","ref":"server/internal/store/content.go","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/server/internal/store/content.go#L85","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: server/internal/store/identity.go:16 and server/internal/store/identity.go:29","ref":"server/internal/store/identity.go","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/server/internal/store/identity.go#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/App.jsx:103 and src/hooks/useViewport.js:320","ref":"src/App.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/App.jsx#L103","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/components/Controls/Controls.jsx:46 and src/components/Controls/OrgChartControls.jsx:128","ref":"src/components/Controls/Controls.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/components/Controls/Controls.jsx#L46","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/components/Controls/OrgChartMenu.jsx:5 and src/components/Controls/TimelineMenu.jsx:5","ref":"src/components/Controls/OrgChartMenu.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/components/Controls/OrgChartMenu.jsx#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/components/EventEditor/EventEditor.jsx:9 and src/components/EventModal/EventModal.jsx:7","ref":"src/components/EventEditor/EventEditor.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/components/EventEditor/EventEditor.jsx#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/components/EventEditor/EventEditor.jsx:103 and src/components/GroupEditor/GroupEditor.jsx:42","ref":"src/components/EventEditor/EventEditor.jsx","url":"https://github.com/ybizeul/timeline/blob/ac8db73ec5bb3f6194f35b45ad61f3c1edbf5db3/src/components/EventEditor/EventEditor.jsx#L103","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":2.0,"scanned_lines":10511.0,"category:best-practice":2.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/components/Controls/OrgChartMenu.jsx","line":164,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/components/Controls/OrgChartMenu.jsx:164"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/components/Controls/TimelineMenu.jsx","line":161,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/components/Controls/TimelineMenu.jsx:161"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":10511.0,"test_ratio":0.0,"ci_files":2.0,"cochange_share":0.0,"cochange_commits":71.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/deploy.yml","ref":".github/workflows/deploy.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/docker.yml","ref":".github/workflows/docker.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":183.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}