{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:16:19.260520Z","repo":{"ref":{"host":"github.com","owner":"zilliztech","name":"memsearch"},"default_branch":"main","clone_url":"https://github.com/zilliztech/memsearch.git","html_url":"https://github.com/zilliztech/memsearch","description":"A persistent, unified memory layer for all your AI agents (e.g. Claude Code, Codex, DSH), backed by Markdown and Milvus.","stars":2872,"forks":287,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":27372,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-02-09T02:29:16Z","pushed_at":"2026-11-13T09:22:22Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-04-12T08:51:50Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"3e296a379cbd4605debde8571b2c7f61f27399a5","profile":{"lines_by_language":{"Python":24872,"JavaScript":5710,"Shell":3651,"TypeScript":3344},"files_by_category":{"docs":162,"source":80,"test":65,"config":35,"other":8,"binary":5,"oversized":1,"generated":1},"source_lines":20178,"test_lines":17399},"pillars":{"ai_provenance":{"score":22.5,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.2247,"suspected_share":0.108,"estimated_share":0.2247,"ai_artifacts":1.0,"flagged_work_units":3.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 22% of first-party code added; an estimated 22% including velocity signals."},"quality":{"score":63.6,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":59.2,"duplication":24.3,"lint":55.3,"testing":100.0,"docs":80.0,"type_safety":8.4,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.86, CI runs tests; 17% of function code in complex or long functions; 24% duplicated lines. Weakest area: type safety."},"security":{"score":45.1,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":64.6,"dependencies":3.3,"ci_actions":0.0,"posture":20.0,"scorecard":null},"summary":"Security posture is poor: 177 known vulnerabilities in 26 dependencies; 28 high-severity SAST findings; 43 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":36.0,"checked":36.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":442.0,"attributed_commits":164.0,"attributed_commit_share":0.37104072398190047,"effective_loc":47106.0,"attributed_loc":10583.0,"attributed_loc_share":0.22466352481637158,"tools_detected":3.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 138 attributed commits, 3,853 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 23 attributed commits, 6,650 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 3 attributed commits, 80 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/workbuddy-integration'","ref":"0f1ff2c119f4a89ca612c8f833125389ee4be7e1","url":"https://github.com/zilliztech/memsearch/commit/0f1ff2c119f4a89ca612c8f833125389ee4be7e1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"d4ce83feb16b2771054c346aeaa64acac3def6e3","url":"https://github.com/zilliztech/memsearch/commit/d4ce83feb16b2771054c346aeaa64acac3def6e3","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/opencode-windows-runtime'","ref":"c7137ca5c03a24be182b6200ac2287e15fe7a481","url":"https://github.com/zilliztech/memsearch/commit/c7137ca5c03a24be182b6200ac2287e15fe7a481","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/dsh-headless-credential-guide'","ref":"67633f539718455a5f14d3956930dc4438a0cf43","url":"https://github.com/zilliztech/memsearch/commit/67633f539718455a5f14d3956930dc4438a0cf43","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/refresh-readme-demo'","ref":"e9e2a0713875cf7310e583a7e4c0ff332d485056","url":"https://github.com/zilliztech/memsearch/commit/e9e2a0713875cf7310e583a7e4c0ff332d485056","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/dsh-recall-hint'","ref":"5e51b46ed8ae5c1edca1c109685bf1cdca8b6cfe","url":"https://github.com/zilliztech/memsearch/commit/5e51b46ed8ae5c1edca1c109685bf1cdca8b6cfe","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/dsh-web-route-auth'","ref":"c1383ff28cb1874a522d6575252fc6e240159fc8","url":"https://github.com/zilliztech/memsearch/commit/c1383ff28cb1874a522d6575252fc6e240159fc8","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/codex-macos-tempfile'","ref":"60e8470357350530e35cb70fac8c167f7c130432","url":"https://github.com/zilliztech/memsearch/commit/60e8470357350530e35cb70fac8c167f7c130432","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/dsh-windows-runtime'","ref":"64e507599ac02bb1da88e5f0d37d0fa426ae0d1e","url":"https://github.com/zilliztech/memsearch/commit/64e507599ac02bb1da88e5f0d37d0fa426ae0d1e","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/release-v0.4.22'","ref":"ed124cc37d4c40d17768fb52a824654a1cd34a9f","url":"https://github.com/zilliztech/memsearch/commit/ed124cc37d4c40d17768fb52a824654a1cd34a9f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-claude-stop-root'","ref":"e4e9a02fd2e32c42c0af4a64fa42c93b7abc65e7","url":"https://github.com/zilliztech/memsearch/commit/e4e9a02fd2e32c42c0af4a64fa42c93b7abc65e7","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/docs-embedding-defaults'","ref":"de29d724ce87a8f0b690c91c6983db565f7f1250","url":"https://github.com/zilliztech/memsearch/commit/de29d724ce87a8f0b690c91c6983db565f7f1250","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/dsh-onnx-default'","ref":"ebd3d372196039b626f8706bc742a34573daf113","url":"https://github.com/zilliztech/memsearch/commit/ebd3d372196039b626f8706bc742a34573daf113","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"c0501d81c2e39c6a315f6bd2e623483d85d66bc2","url":"https://github.com/zilliztech/memsearch/commit/c0501d81c2e39c6a315f6bd2e623483d85d66bc2","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-opencode-scan-cache'","ref":"85fb877572fd17906b1674e575c9a56897851b09","url":"https://github.com/zilliztech/memsearch/commit/85fb877572fd17906b1674e575c9a56897851b09","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/opencode-docs-cleanup'","ref":"3ae4204c9ea4ae45c28d629416001474532fca91","url":"https://github.com/zilliztech/memsearch/commit/3ae4204c9ea4ae45c28d629416001474532fca91","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/opencode-v2'","ref":"abd502245e4d139ad552a2eeee051713cfd07cd9","url":"https://github.com/zilliztech/memsearch/commit/abd502245e4d139ad552a2eeee051713cfd07cd9","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-openclaw-tool-contracts'","ref":"2e64124920130ebf1fea30d05f405a9131f8db83","url":"https://github.com/zilliztech/memsearch/commit/2e64124920130ebf1fea30d05f405a9131f8db83","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/s703-windows-lite-best-effort'","ref":"12661df2eeb85fa28736b00c6d8ee83b606f920d","url":"https://github.com/zilliztech/memsearch/commit/12661df2eeb85fa28736b00c6d8ee83b606f920d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/docs-release-skill-guidance'","ref":"6ff927142eb3a50e24c5294e970d546aec76349c","url":"https://github.com/zilliztech/memsearch/commit/6ff927142eb3a50e24c5294e970d546aec76349c","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/dsh-trusted-publishing'","ref":"f91f5d3c6aa9081cee9c3bcaacb3a81561f5d58a","url":"https://github.com/zilliztech/memsearch/commit/f91f5d3c6aa9081cee9c3bcaacb3a81561f5d58a","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/docs-use-codex-name'","ref":"c5a765a750be9a4d1c024e536d006ed31a08e94f","url":"https://github.com/zilliztech/memsearch/commit/c5a765a750be9a4d1c024e536d006ed31a08e94f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/docs-dsh-plugin-support'","ref":"357ae74d573981519fc2052f84e0851570b65821","url":"https://github.com/zilliztech/memsearch/commit/357ae74d573981519fc2052f84e0851570b65821","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-dsh-memsearch-browser'","ref":"0a3e754f2204c91e38fe3866cfa0abdcaec9bf46","url":"https://github.com/zilliztech/memsearch/commit/0a3e754f2204c91e38fe3866cfa0abdcaec9bf46","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"9b003fc3cb9b2575b96fbccf852146309f64e8be","url":"https://github.com/zilliztech/memsearch/commit/9b003fc3cb9b2575b96fbccf852146309f64e8be","weight":0.9}],"data":{"attributed_loc_by_commit":{"aabbda06f23e95a0bd34cb81214839e45d71f131":0,"264caac3daf2285ed6cc48cc6bfb7e8ed3005cb3":17,"33b4cce3eb92ec3798468105665b754308499a6c":118,"90553978c1465d4c5d031b5c5c08b588fdd5311b":0,"830dd6cc82b8e4833332da9bd003edd0231af46c":17,"acf8d3dc922c26e02174fa2d20833f0663de22fa":29,"34dd25d5a23681c8d254018a1e0967766e8c9e93":5,"ca5e729ed62745d100ae38633d87061f8fa6d541":38,"2685916ab1c132f31985b4c4b80a978976b72cba":43,"d8e7d4ebc739340f3a5f58deadd1e415980eb24e":25,"16558df5ea95fbac582c75f90e74a327ed9ce747":44,"27ffda474c6e1bfbc20bd534ea65001d9f6e3f90":42,"39e7fdc30cd135b76112c33d269475d37b01fb16":718,"5e55322d1e5a535cd20d1e0817ec54069a633e97":0,"94613b265b07aede058369d85db28ca6e9edd856":0,"9c3279f85fc317c388c1652f202d8e1bfe4ec4bd":0,"9cd19db08aa94ad77d300fa1faf110b0ac1fd8e5":1,"cac7a7adfb836e2c54cee5e735088be0c66e73fe":0,"8ccd60b8136829ad7830863cb05e26bdd18923a1":182,"90aaad3ab6c511664a1486e99848c28f7ac71eff":0,"6825c057561cf99e91a87deb0556411b048a6b8a":0,"b003e53cde49beab38bc3b70c7e4eda9ea16a55d":111,"8bca7be2e56b9b713af376f0485850d0479c662e":53,"e187560835466eaada8cc128a6839e922440daed":181,"d04990909a6ad5f4daeb1a5efd408b617f46520b":5,"8c9de15e94c5d1a2f80ef7422da747f8bde1ef89":16,"3fe31ffacb1d6000a59c9d03531abd446065c4c3":539,"7d4690eab9f5ad1e4f54854e3456eab6db1cd6be":0,"833aae1f77cf8c2a7277d04612046e1c47ef9281":0,"c06b3c8818ac6e178346b631bdeef0e32170a859":0,"188c79674a6c36a1ff058f7fb82c1ef2d218c11b":25,"d3e7a04dbbf9f5f5c39cc2a1515c53a011a42ba1":0,"d489147836d92665216cf905ae1483cc7cde0605":0,"5693c2f6e8bae1e48c8c446673e9e949fcab0451":0,"b71c7642d6d1c0b4b4c1298af4e770dd58c379c3":0,"bd5c7d2468622d18bebdc8a4f13b8f8dc7c76558":0,"1d50197e48a0be04ea87b7de3319d1621ad59199":0,"972b9a1de27c026869972d09e8cd665142f49ea5":0,"77adb6992f65a3921931cbbd013d11bd3b8ce235":0,"055686f0fdfa442515c6da03f5e20d12f6c934a3":0,"f3a9584b2c25659ecec30020f7b32aa558fca9c3":0,"1557b2e90804372298101fce3f92e59d3f6e3c26":1,"f1676cad0cd9ebec4d81812a21f86bd10f6df9a4":49,"5dc4773c9c0076b443bbf1890349eaad88185126":0,"364d0b663f98479d7c95a2aa7581404af4b50464":0,"a6b835ceea1d08e6102c311105cd856e6aa0e5e1":0,"a59bbde574462cd7fb890e3f2762bcc99db0bcb4":0,"551ab3882c9faff50c6789db425fcd5e95937d04":0,"a488fd4b971f488706439a1aebdb7194a4131dd6":0,"5a9a337ecf3c4f8af9e430a2922a0f4c865c7979":0,"dda39f7e2f9420d8c2b9dddce78d6ff852c9324e":0,"6dbbb4fb07ffa617c5d9b19f00a82dc8c165c02f":0,"dc153bc077f2a65a24c6d3e9575585a75fc358cb":0,"66276c9ccf0f17d605d8626c4b7f28d8308fa9ed":26,"33ee0feb8d71559fc344369719f89a3a9e227255":0,"fc0b98796bd9e3898f691e785010cab3eecedabe":9,"0f88c7e1071b23a4bd5ad6141589aec9f6dce8f0":0,"589dbec5c2ebaf12b06f2d607e39035fcf31bd76":0,"79bd4ec2792eff3394fab23422cd01859fab8ba5":63,"fc78b8e255933fdca475192d83a6c3c2344b2795":0,"ff2236e39763188c4009b29581f43e557b05bc2f":0,"fb345ab884362374aa9a960727a4f4c57d68f6df":0,"682ccb94b10a8a40064429e47bb451cf0c96a2c3":0,"0f695851291113341c9d79b74ac8d6351869253a":0,"cd3219f45bcdeff90d6c3cbd55b11fecda5c3743":0,"19e2561ba10a034f28afeb7a6df78311d7acb45b":8,"2456864b3060685475befd39de7f04eab41deebe":14,"87185f777b82398107bb1cc164bf15c2e3af6eb4":0,"76f0eff7a41cf2b3c733a70192ae44dbefbb9d3a":0,"8913efc3e0419636e0af1950b1488a23de22dd25":0,"fd5ee3821f0675e3f59cd016e52b9b956ade1046":19,"ee7a39665975c5e046f1085c101d6e3f0fdea601":0,"cbffee9a3e236179a5a9ddb50513b1d23bc785ef":0,"46c82014c726c074e2e2319120f62ac6fa0041ac":0,"c6bc757c26c91daaa9e6ab0cd51b53bd29a78384":0,"9c3b17eb03fc0af9d3af4d607fb605b570155b7c":0,"bdeaa7882bdcbc25063390bdd888657478b80594":0,"c2aaeb1f2fefe99fb159fa8833bc195329ad129f":0,"1f5b04823489891b08f417ef4f6f4205563784e0":0,"e5202fa1664e363979e94237389017f204d5ae56":0,"87aa1813c6f4baaac138c15d33b809906d1edebb":0,"ea68c0376fe09617f184e197463147c20966f91f":0,"bc423dfaef3a6a9f5dcabdb0c9ddb6a35046867e":0,"285eaae4cea83c62c6e96245a9b42881b4e0e106":69,"adf324b446d0cecca5ad5db7867692e45899a132":0,"bf5e0276fcb2c31f2eb4594cf79253029a975226":6,"abb4513faf900daf3ed54d3231b614311f4799df":0,"77d7f4b635a84ebb4017f395a4a7abd7091d72c0":0,"2ed4ca4ae3cd4eaa4d64d61e7a6171261fa5994f":0,"db13debfba418f22847e1d356c3f5e0859018aa9":10,"891fa02fd22e74d48795fb7c0c6c9c5e3ae3c024":0,"ee847893a7b0270d6f076b14a088f81eaf78b91b":0,"92bc4e3b829f2cb30417c0cef5671917d3351adc":0,"27428d3e839cb7d1fb1955519aef0620e57a5efb":0,"ce65819c89097a18ee39b0116cad20d252123faf":27,"99ecef9ab19d52e21f7dbff02c9fb3f7a148337f":18,"0add19cc536192794691b22adf78eb871aa981f7":5,"7fe155b9e8aa95be4e6898cc88beb2ada323b19b":13,"b76ad9bbf69a4469e699319a3f07c3e72dc9af92":4,"161daa8612be53469958e862a6d73677567392ee":0,"b11ad6b6407e6643c325cc77902f94a88b65ea25":8,"da303ae14da9b328b62d74366f7c27a1fcb3f37d":0,"0079521f663f6f643b0d2b863e4c9aec188c18d5":77,"792475d63be2ea7d5284698f9a0a600005e171b6":0,"5e3156277dd92b8278e8401a91085faa8bff2053":10,"2cd07729eb65246b3a6dc8692d0a55f2969ece9b":12,"67819864644c799cb58ff97ac8153292ddacf5e3":0,"ef76eeeb90f000f3a46dea7577f3ff860bedda8b":0,"6e7267db66a27830d87a8e1d41e7864c18358543":0,"713dd954c349ce207aee2650351d21dfd3b3b98b":67,"07c889e83733ccf0d86821fdd0f6bf9038aa77a3":0,"2120fad322b68c56999d1ce5e16cbeee513d1f3b":0,"684f34493b30f89d398aed62a37eca9a17fe804a":0,"cf6be82aa39473c9e2fc19d564ebecab5d39d6ad":0,"bf7230ba43af4100ab4cd547f005a7282ade48ae":66,"e96cdae22d12327a0cce2497148f9f94aae8456d":0,"2965023bfa04dfca7d7e59d54fc87bf3a3386ce7":271,"280695b7be30f53047ee2dc56977fb60d533266e":0,"b6f5945cecfb0aa069af6ded6bd206081e78c469":0,"05fa69f6edec4c6765edb96e503b9f66f3398e5c":76,"215fc74d5cf4ca08c686e96bcef484573efe495c":4,"ef62750a1ae2d800574b23cd6f5b8d005c8fc48e":0,"7ad5a7fdae463c85d4fd3a8431842c8d8d928fdc":157,"afe90d1d7fa4a537feb963c59b05d3480f5311d0":53,"688f9040f5c0b21be20662d9118236741caa7004":6,"696d2d3ae13fbb1980ccd9b6c0a45a30d8888a39":1,"1974e94e09575ee678d95a70ec40abaee74406e8":0,"86bd56b234b54aacc9e77bafebb285a9bfc244f0":94,"93a61b157716aff645752a32b550b11e0bdf13a1":0,"92b54888ab9f5db14bfbced44c4c9f866c2bbaba":0,"093671986b276286751fee25cb6be37781d32b6e":0,"b1c5d655bdea319f59b28a0ecd96434b430ccd9c":2,"015d92870c5a61afe87c8741ae26a5c65b94d5dd":4,"cd67906f4885f8e4a0d3442b4dd71a31afa4fb7d":0,"f3f190d05e9730b862c2cb37c46e46698baa63d9":20,"97a7b336950844b81fad009270ed0666fc793ae8":6,"41ccae51ed6df2a3c07e598b89dc89e3e27366e5":20,"d8386294c910cd17cbdf202cdabd51a8c875d7d4":75,"e0fc02b9e4ddf76aa40dee77724a79a087d83b33":84,"9b003fc3cb9b2575b96fbccf852146309f64e8be":123,"0a3e754f2204c91e38fe3866cfa0abdcaec9bf46":263,"357ae74d573981519fc2052f84e0851570b65821":0,"c5a765a750be9a4d1c024e536d006ed31a08e94f":0,"f91f5d3c6aa9081cee9c3bcaacb3a81561f5d58a":0,"6ff927142eb3a50e24c5294e970d546aec76349c":0,"12661df2eeb85fa28736b00c6d8ee83b606f920d":87,"2e64124920130ebf1fea30d05f405a9131f8db83":1270,"abd502245e4d139ad552a2eeee051713cfd07cd9":3077,"3ae4204c9ea4ae45c28d629416001474532fca91":0,"85fb877572fd17906b1674e575c9a56897851b09":67,"c0501d81c2e39c6a315f6bd2e623483d85d66bc2":75,"ebd3d372196039b626f8706bc742a34573daf113":61,"de29d724ce87a8f0b690c91c6983db565f7f1250":0,"e4e9a02fd2e32c42c0af4a64fa42c93b7abc65e7":46,"ed124cc37d4c40d17768fb52a824654a1cd34a9f":0,"64e507599ac02bb1da88e5f0d37d0fa426ae0d1e":549,"60e8470357350530e35cb70fac8c167f7c130432":109,"c1383ff28cb1874a522d6575252fc6e240159fc8":123,"5e51b46ed8ae5c1edca1c109685bf1cdca8b6cfe":149,"e9e2a0713875cf7310e583a7e4c0ff332d485056":0,"67633f539718455a5f14d3956930dc4438a0cf43":9,"c7137ca5c03a24be182b6200ac2287e15fe7a481":187,"d4ce83feb16b2771054c346aeaa64acac3def6e3":147,"0f1ff2c119f4a89ca612c8f833125389ee4be7e1":578},"tools":{"claude-code":{"name":"Claude Code","commits":138,"loc":3853,"first_seen":1770603102,"last_seen":1794280437},"github-copilot":{"name":"GitHub Copilot coding agent","commits":3,"loc":80,"first_seen":1772597941,"last_seen":1772599065},"openai-codex":{"name":"OpenAI Codex","commits":23,"loc":6650,"first_seen":1781162376,"last_seen":1794561136}},"monthly":{"2026-02":{"loc":5205,"attributed_loc":3061},"2026-03":{"loc":4309,"attributed_loc":397},"2026-04":{"loc":2118,"attributed_loc":46},"2026-05":{"loc":6174,"attributed_loc":0},"2026-06":{"loc":4819,"attributed_loc":75},"2026-07":{"loc":3505,"attributed_loc":207},"2026-08":{"loc":6565,"attributed_loc":350},"2026-09":{"loc":6230,"attributed_loc":0},"2026-10":{"loc":6506,"attributed_loc":5526},"2026-11":{"loc":1675,"attributed_loc":921}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1771137269.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1771137269}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":214.0,"flagged_units":3.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":47106.0,"flagged_loc":8164.0,"flagged_loc_share":0.17331125546639495,"max_loc_per_hour":749.01616065995,"median_loc_per_hour":61.63038839095177,"pr_timed_units":173.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,077 lines of first-party code in ~4.1h (749 lines/hour, PR #800)","ref":"abd502245e4d139ad552a2eeee051713cfd07cd9","url":"https://github.com/zilliztech/memsearch/commit/abd502245e4d139ad552a2eeee051713cfd07cd9","weight":0.22470484819798497},{"kind":"velocity-burst","description":"2,608 lines of first-party code in ~4.1h (642 lines/hour, PR #238)","ref":"345721333a1d4f591fcba2580eb3d9a89fa27f8c","url":"https://github.com/zilliztech/memsearch/commit/345721333a1d4f591fcba2580eb3d9a89fa27f8c","weight":0.19264345803980573},{"kind":"velocity-burst","description":"2,479 lines of first-party code in ~4.1h (608 lines/hour, PR #554)","ref":"1613780ada47ff52595b19c94d81f6dbacb52d41","url":"https://github.com/zilliztech/memsearch/commit/1613780ada47ff52595b19c94d81f6dbacb52d41","weight":0.18225459496255955}],"data":{"flagged_loc_by_commit":{"345721333a1d4f591fcba2580eb3d9a89fa27f8c":2608,"1613780ada47ff52595b19c94d81f6dbacb52d41":2479,"abd502245e4d139ad552a2eeee051713cfd07cd9":3077},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":59.0,"flagged_releases":0.0,"max_loc_per_day":1807.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1.0","to":"v0.1.1","loc":1,"days":0.04,"loc_per_day":24.0,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":49,"days":0.04,"loc_per_day":1176.0,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":0,"days":0.05,"loc_per_day":0.0,"flagged":false},{"from":"v0.1.3","to":"v0.1.4","loc":35,"days":0.07,"loc_per_day":511.7,"flagged":false},{"from":"v0.1.4","to":"v0.1.5","loc":63,"days":0.62,"loc_per_day":100.9,"flagged":false},{"from":"v0.1.5","to":"v0.1.6","loc":8,"days":0.17,"loc_per_day":46.6,"flagged":false},{"from":"v0.1.6","to":"v0.1.7","loc":33,"days":1.35,"loc_per_day":24.4,"flagged":false},{"from":"v0.1.7","to":"v0.1.8","loc":69,"days":1.92,"loc_per_day":35.9,"flagged":false},{"from":"v0.1.8","to":"v0.1.9","loc":6,"days":0.58,"loc_per_day":10.4,"flagged":false},{"from":"v0.1.9","to":"v0.1.10","loc":0,"days":0.12,"loc_per_day":0.0,"flagged":false},{"from":"v0.1.10","to":"v0.1.11","loc":184,"days":2.17,"loc_per_day":84.7,"flagged":false},{"from":"v0.1.11","to":"v0.1.12","loc":192,"days":9.1,"loc_per_day":21.1,"flagged":false},{"from":"v0.1.12","to":"v0.1.13","loc":271,"days":0.58,"loc_per_day":465.1,"flagged":false},{"from":"v0.1.13","to":"v0.1.14","loc":333,"days":3.21,"loc_per_day":103.8,"flagged":false},{"from":"v0.1.14","to":"v0.1.15","loc":124,"days":2.05,"loc_per_day":60.4,"flagged":false},{"from":"v0.1.15","to":"v0.1.16","loc":356,"days":3.78,"loc_per_day":94.1,"flagged":false},{"from":"v0.1.16","to":"v0.1.17","loc":389,"days":10.24,"loc_per_day":38.0,"flagged":false},{"from":"v0.1.17","to":"v0.1.18","loc":129,"days":2.88,"loc_per_day":44.8,"flagged":false},{"from":"v0.1.18","to":"v0.1.19","loc":72,"days":0.83,"loc_per_day":86.5,"flagged":false},{"from":"v0.1.19","to":"v0.2.0","loc":2615,"days":7.29,"loc_per_day":358.7,"flagged":false},{"from":"v0.2.0","to":"v0.2.1","loc":392,"days":0.74,"loc_per_day":529.6,"flagged":false},{"from":"v0.2.1","to":"v0.2.2","loc":39,"days":0.32,"loc_per_day":122.6,"flagged":false},{"from":"v0.2.2","to":"v0.2.3","loc":549,"days":7.85,"loc_per_day":69.9,"flagged":false},{"from":"v0.2.3","to":"v0.2.4","loc":245,"days":1.79,"loc_per_day":137.2,"flagged":false},{"from":"v0.2.4","to":"v0.3.0","loc":190,"days":4.31,"loc_per_day":44.1,"flagged":false},{"from":"v0.3.0","to":"v0.3.1","loc":828,"days":2.01,"loc_per_day":412.6,"flagged":false},{"from":"v0.3.1","to":"v0.4.0","loc":217,"days":5.99,"loc_per_day":36.2,"flagged":false},{"from":"v0.4.0","to":"v0.4.1","loc":89,"days":7.69,"loc_per_day":11.6,"flagged":false},{"from":"v0.4.1","to":"v0.4.2","loc":923,"days":9.02,"loc_per_day":102.3,"flagged":false},{"from":"v0.4.2","to":"v0.4.3","loc":1843,"days":9.21,"loc_per_day":200.1,"flagged":false},{"from":"v0.4.3","to":"v0.4.4","loc":427,"days":3.13,"loc_per_day":136.3,"flagged":false},{"from":"v0.4.4","to":"v0.4.5","loc":2479,"days":6.95,"loc_per_day":356.7,"flagged":false},{"from":"v0.4.5","to":"v0.4.6","loc":502,"days":0.89,"loc_per_day":564.4,"flagged":false},{"from":"v0.4.6","to":"v0.4.7","loc":1904,"days":13.79,"loc_per_day":138.1,"flagged":false},{"from":"v0.4.7","to":"v0.4.8","loc":1115,"days":3.55,"loc_per_day":314.5,"flagged":false},{"from":"v0.4.8","to":"v0.4.9","loc":539,"days":0.68,"loc_per_day":798.1,"flagged":false},{"from":"v0.4.9","to":"v0.4.10","loc":596,"days":0.33,"loc_per_day":1807.5,"flagged":false},{"from":"v0.4.10","to":"v0.4.11","loc":592,"days":5.76,"loc_per_day":102.7,"flagged":false},{"from":"v0.4.11","to":"v0.4.12","loc":73,"days":8.24,"loc_per_day":8.9,"flagged":false},{"from":"v0.4.12","to":"v0.4.13","loc":401,"days":9.72,"loc_per_day":41.2,"flagged":false},{"from":"v0.4.13","to":"v0.4.14","loc":435,"days":2.91,"loc_per_day":149.4,"flagged":false},{"from":"v0.4.14","to":"v0.4.15","loc":1178,"days":7.11,"loc_per_day":165.6,"flagged":false},{"from":"v0.4.15","to":"v0.4.16","loc":996,"days":3.02,"loc_per_day":329.7,"flagged":false},{"from":"v0.4.16","to":"v0.4.17","loc":495,"days":7.97,"loc_per_day":62.1,"flagged":false},{"from":"v0.4.17","to":"v0.4.18","loc":4081,"days":18.72,"loc_per_day":218.0,"flagged":false},{"from":"v0.4.18","to":"v0.4.19","loc":1782,"days":3.94,"loc_per_day":452.2,"flagged":false},{"from":"v0.4.19","to":"dsh-v0.1.4","loc":382,"days":5.87,"loc_per_day":65.1,"flagged":false},{"from":"dsh-v0.1.4","to":"dsh-v0.1.5","loc":3424,"days":14.28,"loc_per_day":239.7,"flagged":false},{"from":"dsh-v0.1.5","to":"v0.4.20","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.4.20","to":"openclaw-v0.3.19","loc":155,"days":0.51,"loc_per_day":304.9,"flagged":false},{"from":"openclaw-v0.3.19","to":"v0.4.21","loc":2971,"days":11.62,"loc_per_day":255.6,"flagged":false},{"from":"v0.4.21","to":"dsh-v0.1.6","loc":17,"days":15.16,"loc_per_day":1.1,"flagged":false},{"from":"dsh-v0.1.6","to":"dsh-v0.1.7","loc":5454,"days":13.9,"loc_per_day":392.4,"flagged":false},{"from":"dsh-v0.1.7","to":"v0.4.22","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.4.22","to":"dsh-v0.1.8","loc":1035,"days":3.75,"loc_per_day":275.7,"flagged":false},{"from":"dsh-v0.1.8","to":"v0.4.23","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.4.23","to":"dsh-v0.1.9","loc":1097,"days":14.02,"loc_per_day":78.2,"flagged":false},{"from":"dsh-v0.1.9","to":"openclaw-v0.3.23","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"openclaw-v0.3.23","to":"v0.4.24","loc":578,"days":3.22,"loc_per_day":179.6,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":20178.0,"index":0.198,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":8.0,"per_kloc:emoji_in_code":0.396,"files:emoji_in_code":3.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":35.0,"findings_high":28.0,"findings_medium":7.0,"findings_low":0.0,"weighted_findings":25.2,"scanned_lines":20178.0,"parse_errors":5.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/_shared/scripts/maintenance-runner.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/_shared/scripts/maintenance-runner.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/_shared/scripts/maintenance-runner.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/_shared/scripts/maintenance-runner.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"plugins/_shared/scripts/maintenance-runner.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:plugins/_shared/scripts/maintenance-runner.py:106"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/claude-code/scripts/maintenance-runner.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/claude-code/scripts/maintenance-runner.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/claude-code/scripts/maintenance-runner.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/claude-code/scripts/maintenance-runner.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"plugins/claude-code/scripts/maintenance-runner.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:plugins/claude-code/scripts/maintenance-runner.py:106"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/codex/scripts/maintenance-runner.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/codex/scripts/maintenance-runner.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/codex/scripts/maintenance-runner.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/codex/scripts/maintenance-runner.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"plugins/codex/scripts/maintenance-runner.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:plugins/codex/scripts/maintenance-runner.py:106"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/dsh/scripts/maintenance-runner.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/dsh/scripts/maintenance-runner.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/dsh/scripts/maintenance-runner.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/dsh/scripts/maintenance-runner.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"plugins/dsh/scripts/maintenance-runner.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:plugins/dsh/scripts/maintenance-runner.py:106"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/dsh/scripts/parse-transcript.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/dsh/scripts/parse-transcript.py:63"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/dsh/scripts/summarize.py","line":58,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/dsh/scripts/summarize.py:58"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"plugins/dsh/scripts/summarize.py","line":59,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:plugins/dsh/scripts/summarize.py:59"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/openclaw/scripts/maintenance-runner.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/openclaw/scripts/maintenance-runner.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/openclaw/scripts/maintenance-runner.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/openclaw/scripts/maintenance-runner.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"plugins/openclaw/scripts/maintenance-runner.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:plugins/openclaw/scripts/maintenance-runner.py:106"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/opencode/scripts/capture.py","line":108,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/opencode/scripts/capture.py:108"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/opencode/scripts/capture.py","line":395,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/opencode/scripts/capture.py:395"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"plugins/opencode/scripts/capture.py","line":395,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:plugins/opencode/scripts/capture.py:395"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/opencode/scripts/capture.py","line":435,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/opencode/scripts/capture.py:435"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"plugins/opencode/scripts/capture.py","line":436,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:plugins/opencode/scripts/capture.py:436"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/opencode/scripts/maintenance-runner.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/opencode/scripts/maintenance-runner.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"plugins/opencode/scripts/maintenance-runner.py","line":105,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:plugins/opencode/scripts/maintenance-runner.py:105"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"plugins/opencode/scripts/maintenance-runner.py","line":106,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:plugins/opencode/scripts/maintenance-runner.py:106"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"plugins/opencode/scripts/opencode_turns.py","line":62,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:plugins/opencode/scripts/opencode_turns.py:62"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/memsearch/maintenance.py","line":558,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/memsearch/maintenance.py:558"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"evaluation/rerank_evaluate.py","line":62,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:evaluation/rerank_evaluate.py:62"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\s*\\|?\\s*:?-{2,}:?\\s*(\\|\\s*:?-{2,}:?\\s*)*\\|?\\s*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if p [confidence low]","path":"plugins/dsh/client.js","line":291,"fingerprint":"javascript.lang.security.audit.detect-redos:plugins/dsh/client.js:291"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/dsh/index.js","line":601,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/dsh/index.js:601"},{"rule_id":"opengrep/python.lang.security.audit.formatted-sql-query","severity":"medium","message":"Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]","path":"plugins/opencode/scripts/opencode_turns.py","line":62,"fingerprint":"python.lang.security.audit.formatted-sql-query:plugins/opencode/scripts/opencode_turns.py:62"},{"rule_id":"opengrep/python.lang.security.audit.non-literal-import","severity":"medium","message":"Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low]","path":"src/memsearch/embeddings/__init__.py","line":92,"fingerprint":"python.lang.security.audit.non-literal-import:src/memsearch/embeddings/__init__.py:92"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"src/memsearch/jev_reranker.py","line":100,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:src/memsearch/jev_reranker.py:100"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"src/memsearch/skills.py","line":265,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:src/memsearch/skills.py:265"}],"evidence":[],"data":{"rulesets":["python","bash","javascript","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":26.0,"vulnerabilities":177.0,"vulns_critical":12.0,"vulns_high":96.0,"vulns_medium":59.0,"vulns_low":9.0,"vulns_unknown":1.0,"penalty":205.0},"findings":[{"rule_id":"osv/GHSA-63hf-3vf5-4wqf","severity":"critical","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2102, GHSA-63hf-3vf5-4wqf","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-63hf-3vf5-4wqf"},{"rule_id":"osv/GHSA-82r6-8w77-94w6","severity":"critical","message":"anyio@4.12.1 (PyPI) is affected by PYSEC-2026-4025, GHSA-82r6-8w77-94w6","path":"uv.lock","line":null,"fingerprint":"anyio@4.12.1 (PyPI):GHSA-82r6-8w77-94w6"},{"rule_id":"osv/GHSA-6q48-6c7w-9gw2","severity":"critical","message":"certifi@2026.1.4 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2","path":"uv.lock","line":null,"fingerprint":"certifi@2026.1.4 (PyPI):GHSA-6q48-6c7w-9gw2"},{"rule_id":"osv/GHSA-p423-j2cm-9vmq","severity":"critical","message":"cryptography@46.0.4 (PyPI) is affected by PYSEC-2026-36, GHSA-p423-j2cm-9vmq","path":"uv.lock","line":null,"fingerprint":"cryptography@46.0.4 (PyPI):GHSA-p423-j2cm-9vmq"},{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-v9pv-5gc8-w2m6","severity":"critical","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-v9pv-5gc8-w2m6"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@12.1.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@12.1.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-jhr6-gm9c-rqjv","severity":"critical","message":"sentence-transformers@5.2.2 (PyPI) is affected by PYSEC-2026-4164, GHSA-jhr6-gm9c-rqjv","path":"uv.lock","line":null,"fingerprint":"sentence-transformers@5.2.2 (PyPI):GHSA-jhr6-gm9c-rqjv"},{"rule_id":"osv/GHSA-fgcw-684q-jj6r","severity":"critical","message":"transformers@4.57.6 (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r","path":"uv.lock","line":null,"fingerprint":"transformers@4.57.6 (PyPI):GHSA-fgcw-684q-jj6r"},{"rule_id":"osv/GHSA-hcc4-c3v8-rx92","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2095, GHSA-hcc4-c3v8-rx92","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-hcc4-c3v8-rx92"},{"rule_id":"osv/GHSA-p998-jp59-783m","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2097, GHSA-p998-jp59-783m","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-p998-jp59-783m"},{"rule_id":"osv/GHSA-m5qp-6w8w-w647","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2098, GHSA-m5qp-6w8w-w647","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-m5qp-6w8w-w647"},{"rule_id":"osv/GHSA-jg22-mg44-37j8","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2104, GHSA-jg22-mg44-37j8","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-jg22-mg44-37j8"},{"rule_id":"osv/GHSA-hg6j-4rv6-33pg","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2105, GHSA-hg6j-4rv6-33pg","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-hg6j-4rv6-33pg"},{"rule_id":"osv/GHSA-m6qw-4cw2-hm4m","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2106, GHSA-m6qw-4cw2-hm4m","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-m6qw-4cw2-hm4m"},{"rule_id":"osv/GHSA-4fvr-rgm6-gqmc","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2107, GHSA-4fvr-rgm6-gqmc","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-4fvr-rgm6-gqmc"},{"rule_id":"osv/GHSA-xcgm-r5h9-7989","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2108, GHSA-xcgm-r5h9-7989","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-xcgm-r5h9-7989"},{"rule_id":"osv/GHSA-63hw-fmq6-xxg2","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2110, GHSA-63hw-fmq6-xxg2","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-63hw-fmq6-xxg2"},{"rule_id":"osv/GHSA-g3cq-j2xw-wf74","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2111, GHSA-g3cq-j2xw-wf74","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-g3cq-j2xw-wf74"},{"rule_id":"osv/GHSA-2fqr-mr3j-6wp8","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2112, GHSA-2fqr-mr3j-6wp8","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-2fqr-mr3j-6wp8"},{"rule_id":"osv/GHSA-9x8q-7h8h-wcw9","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2113, GHSA-9x8q-7h8h-wcw9","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-9x8q-7h8h-wcw9"},{"rule_id":"osv/GHSA-4m7w-qmgq-4wj5","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-237, GHSA-4m7w-qmgq-4wj5","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-4m7w-qmgq-4wj5"},{"rule_id":"osv/GHSA-cq5v-8q36-5273","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-3545, GHSA-cq5v-8q36-5273","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-cq5v-8q36-5273"},{"rule_id":"osv/GHSA-2g87-pp6c-29x5","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-2g87-pp6c-29x5","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-2g87-pp6c-29x5"},{"rule_id":"osv/GHSA-5wr8-gcqf-gqf3","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-5wr8-gcqf-gqf3","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-5wr8-gcqf-gqf3"},{"rule_id":"osv/GHSA-9xw5-w5jj-pvcg","severity":"high","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-9xw5-w5jj-pvcg","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-9xw5-w5jj-pvcg"},{"rule_id":"osv/GHSA-r6ph-v2qm-q3c2","severity":"high","message":"cryptography@46.0.4 (PyPI) is affected by PYSEC-2026-2141, GHSA-r6ph-v2qm-q3c2","path":"uv.lock","line":null,"fingerprint":"cryptography@46.0.4 (PyPI):GHSA-r6ph-v2qm-q3c2"},{"rule_id":"osv/GHSA-g6cj-pr64-35w5","severity":"high","message":"cryptography@46.0.4 (PyPI) is affected by PYSEC-2026-3552, GHSA-g6cj-pr64-35w5","path":"uv.lock","line":null,"fingerprint":"cryptography@46.0.4 (PyPI):GHSA-g6cj-pr64-35w5"},{"rule_id":"osv/GHSA-jwv3-5hgf-82ww","severity":"high","message":"cryptography@46.0.4 (PyPI) is affected by PYSEC-2026-3553, GHSA-jwv3-5hgf-82ww","path":"uv.lock","line":null,"fingerprint":"cryptography@46.0.4 (PyPI):GHSA-jwv3-5hgf-82ww"},{"rule_id":"osv/GHSA-537c-gmf6-5ccf","severity":"high","message":"cryptography@46.0.4 (PyPI) is affected by GHSA-537c-gmf6-5ccf","path":"uv.lock","line":null,"fingerprint":"cryptography@46.0.4 (PyPI):GHSA-537c-gmf6-5ccf"},{"rule_id":"osv/GHSA-v4x8-3wr5-3wq8","severity":"high","message":"filelock@3.25.2 (PyPI) is affected by GHSA-v4x8-3wr5-3wq8","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-v4x8-3wr5-3wq8"},{"rule_id":"osv/GHSA-27vj-qcqg-25rc","severity":"high","message":"fsspec@2026.2.0 (PyPI) is affected by PYSEC-2026-4217, GHSA-27vj-qcqg-25rc","path":"uv.lock","line":null,"fingerprint":"fsspec@2026.2.0 (PyPI):GHSA-27vj-qcqg-25rc"},{"rule_id":"osv/GHSA-qh6h-p6c9-ff54","severity":"high","message":"langchain-core@1.2.9 (PyPI) is affected by PYSEC-2026-2193, GHSA-qh6h-p6c9-ff54","path":"uv.lock","line":null,"fingerprint":"langchain-core@1.2.9 (PyPI):GHSA-qh6h-p6c9-ff54"},{"rule_id":"osv/GHSA-pjwx-r37v-7724","severity":"high","message":"langchain-core@1.2.9 (PyPI) is affected by PYSEC-2026-2564, GHSA-pjwx-r37v-7724","path":"uv.lock","line":null,"fingerprint":"langchain-core@1.2.9 (PyPI):GHSA-pjwx-r37v-7724"},{"rule_id":"osv/GHSA-3644-q5cj-c5c7","severity":"high","message":"langsmith@0.6.9 (PyPI) is affected by PYSEC-2026-2582, GHSA-3644-q5cj-c5c7","path":"uv.lock","line":null,"fingerprint":"langsmith@0.6.9 (PyPI):GHSA-3644-q5cj-c5c7"},{"rule_id":"osv/GHSA-f4xh-w4cj-qxq8","severity":"high","message":"langsmith@0.6.9 (PyPI) is affected by GHSA-f4xh-w4cj-qxq8","path":"uv.lock","line":null,"fingerprint":"langsmith@0.6.9 (PyPI):GHSA-f4xh-w4cj-qxq8"},{"rule_id":"osv/GHSA-cfh3-3jmp-rvhc","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-cfh3-3jmp-rvhc"},{"rule_id":"osv/GHSA-whj4-6x5x-4v2j","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-whj4-6x5x-4v2j"},{"rule_id":"osv/GHSA-pwv6-vv43-88gr","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-pwv6-vv43-88gr"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-pg7v-jwj7-p798","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3452, GHSA-pg7v-jwj7-p798","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-pg7v-jwj7-p798"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-4rr5-89j8-mwwm","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4328, GHSA-4rr5-89j8-mwwm","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-4rr5-89j8-mwwm"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-cp9v-662q-vvx9","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4333, GHSA-cp9v-662q-vvx9","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-cp9v-662q-vvx9"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-g4qv-2jxx-769h","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4342, GHSA-g4qv-2jxx-769h","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-g4qv-2jxx-769h"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-78g4-xqwv-q3g8","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-78g4-xqwv-q3g8","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-78g4-xqwv-q3g8"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@12.1.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/GHSA-jr27-m4p2-rc6r","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by PYSEC-2026-2263, GHSA-jr27-m4p2-rc6r","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-jr27-m4p2-rc6r"},{"rule_id":"osv/GHSA-m4p7-r5rc-7g4j","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by PYSEC-2026-3455, GHSA-m4p7-r5rc-7g4j","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-m4p7-r5rc-7g4j"},{"rule_id":"osv/GHSA-8ppf-4f7h-5ppj","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by PYSEC-2026-3456, GHSA-8ppf-4f7h-5ppj","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-8ppf-4f7h-5ppj"},{"rule_id":"osv/GHSA-hm4w-wwcw-mr6r","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by PYSEC-2026-3457, GHSA-hm4w-wwcw-mr6r","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-hm4w-wwcw-mr6r"},{"rule_id":"osv/GHSA-2qm8-x737-gmw5","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by GHSA-2qm8-x737-gmw5","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-2qm8-x737-gmw5"},{"rule_id":"osv/GHSA-9m75-vc3g-4x39","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by GHSA-9m75-vc3g-4x39","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-9m75-vc3g-4x39"},{"rule_id":"osv/GHSA-fm9c-5rcf-2q5p","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by GHSA-fm9c-5rcf-2q5p","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-fm9c-5rcf-2q5p"},{"rule_id":"osv/GHSA-mm57-4v3p-rchx","severity":"high","message":"pyasn1@0.6.2 (PyPI) is affected by GHSA-mm57-4v3p-rchx","path":"uv.lock","line":null,"fingerprint":"pyasn1@0.6.2 (PyPI):GHSA-mm57-4v3p-rchx"},{"rule_id":"osv/GHSA-gm37-52c6-37mw","severity":"high","message":"pymdown-extensions@10.20.1 (PyPI) is affected by PYSEC-2026-3654, GHSA-gm37-52c6-37mw","path":"uv.lock","line":null,"fingerprint":"pymdown-extensions@10.20.1 (PyPI):GHSA-gm37-52c6-37mw"},{"rule_id":"osv/PYSEC-2026-139","severity":"high","message":"torch@2.10.0 (PyPI) is affected by PYSEC-2026-139","path":"uv.lock","line":null,"fingerprint":"torch@2.10.0 (PyPI):PYSEC-2026-139"},{"rule_id":"osv/PYSEC-2025-217","severity":"high","message":"transformers@4.57.6 (PyPI) is affected by PYSEC-2025-217","path":"uv.lock","line":null,"fingerprint":"transformers@4.57.6 (PyPI):PYSEC-2025-217"},{"rule_id":"osv/GHSA-69w3-r845-3855","severity":"high","message":"transformers@4.57.6 (PyPI) is affected by PYSEC-2026-2288, GHSA-69w3-r845-3855","path":"uv.lock","line":null,"fingerprint":"transformers@4.57.6 (PyPI):GHSA-69w3-r845-3855"},{"rule_id":"osv/GHSA-29pf-2h5f-8g72","severity":"high","message":"transformers@4.57.6 (PyPI) is affected by PYSEC-2026-2289, GHSA-29pf-2h5f-8g72","path":"uv.lock","line":null,"fingerprint":"transformers@4.57.6 (PyPI):GHSA-29pf-2h5f-8g72"},{"rule_id":"osv/GHSA-xrqw-3rrv-vx5w","severity":"high","message":"transformers@4.57.6 (PyPI) is affected by PYSEC-2026-3929, GHSA-xrqw-3rrv-vx5w","path":"uv.lock","line":null,"fingerprint":"transformers@4.57.6 (PyPI):GHSA-xrqw-3rrv-vx5w"},{"rule_id":"osv/GHSA-x9r9-c232-4q39","severity":"high","message":"transformers@4.57.6 (PyPI) is affected by PYSEC-2026-4174, GHSA-x9r9-c232-4q39","path":"uv.lock","line":null,"fingerprint":"transformers@4.57.6 (PyPI):GHSA-x9r9-c232-4q39"},{"rule_id":"osv/GHSA-qccp-gfcp-xxvc","severity":"high","message":"urllib3@2.6.3 (PyPI) is affected by PYSEC-2026-141, GHSA-qccp-gfcp-xxvc","path":"uv.lock","line":null,"fingerprint":"urllib3@2.6.3 (PyPI):GHSA-qccp-gfcp-xxvc"},{"rule_id":"osv/GHSA-mf9v-mfxr-j63j","severity":"high","message":"urllib3@2.6.3 (PyPI) is affected by PYSEC-2026-142, GHSA-mf9v-mfxr-j63j","path":"uv.lock","line":null,"fingerprint":"urllib3@2.6.3 (PyPI):GHSA-mf9v-mfxr-j63j"},{"rule_id":"osv/GHSA-8988-9cw3-xx77","severity":"high","message":"urllib3@2.6.3 (PyPI) is affected by PYSEC-2026-4175, GHSA-8988-9cw3-xx77","path":"uv.lock","line":null,"fingerprint":"urllib3@2.6.3 (PyPI):GHSA-8988-9cw3-xx77"},{"rule_id":"osv/GHSA-vxq7-64xx-v4gw","severity":"high","message":"urllib3@2.6.3 (PyPI) is affected by PYSEC-2026-4177, GHSA-vxq7-64xx-v4gw","path":"uv.lock","line":null,"fingerprint":"urllib3@2.6.3 (PyPI):GHSA-vxq7-64xx-v4gw"},{"rule_id":"osv/GHSA-94p9-xgh2-xp45","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by PYSEC-2026-4011, GHSA-94p9-xgh2-xp45","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-94p9-xgh2-xp45"},{"rule_id":"osv/GHSA-p58f-9548-mpm2","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by PYSEC-2026-4013, GHSA-p58f-9548-mpm2","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-p58f-9548-mpm2"},{"rule_id":"osv/GHSA-x78j-v8h9-3j2q","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by PYSEC-2026-4014, GHSA-x78j-v8h9-3j2q","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-x78j-v8h9-3j2q"},{"rule_id":"osv/GHSA-394h-qwmc-48pf","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-394h-qwmc-48pf","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-394h-qwmc-48pf"},{"rule_id":"osv/GHSA-5vjq-rrrf-7h2q","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-5vjq-rrrf-7h2q","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-5vjq-rrrf-7h2q"},{"rule_id":"osv/GHSA-6w3r-xr62-4xcp","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-6w3r-xr62-4xcp","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-6w3r-xr62-4xcp"},{"rule_id":"osv/GHSA-8rjx-v5ww-45pp","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-8rjx-v5ww-45pp","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-8rjx-v5ww-45pp"},{"rule_id":"osv/GHSA-c947-3pg5-gm8q","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-c947-3pg5-gm8q","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-c947-3pg5-gm8q"},{"rule_id":"osv/GHSA-c978-59m8-c77v","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-c978-59m8-c77v","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-c978-59m8-c77v"},{"rule_id":"osv/GHSA-vxj4-q4g9-crj7","severity":"high","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-vxj4-q4g9-crj7","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-vxj4-q4g9-crj7"},{"rule_id":"osv/GHSA-w2fm-2cpv-w7v5","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2094, GHSA-w2fm-2cpv-w7v5","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-w2fm-2cpv-w7v5"},{"rule_id":"osv/GHSA-2vrm-gr82-f7m5","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2096, GHSA-2vrm-gr82-f7m5","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-2vrm-gr82-f7m5"},{"rule_id":"osv/GHSA-3wq7-rqq7-wx6j","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2099, GHSA-3wq7-rqq7-wx6j","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-3wq7-rqq7-wx6j"},{"rule_id":"osv/GHSA-966j-vmvw-g2g9","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2100, GHSA-966j-vmvw-g2g9","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-966j-vmvw-g2g9"},{"rule_id":"osv/GHSA-mwh4-6h8g-pg8w","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2101, GHSA-mwh4-6h8g-pg8w","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-mwh4-6h8g-pg8w"},{"rule_id":"osv/GHSA-c427-h43c-vf67","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2103, GHSA-c427-h43c-vf67","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-c427-h43c-vf67"},{"rule_id":"osv/GHSA-hpj7-wq8m-9hgp","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-2109, GHSA-hpj7-wq8m-9hgp","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-hpj7-wq8m-9hgp"},{"rule_id":"osv/GHSA-mfx4-hv73-q22v","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-3546, GHSA-mfx4-hv73-q22v","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-mfx4-hv73-q22v"},{"rule_id":"osv/GHSA-mq44-7p77-q5h7","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by PYSEC-2026-3547, GHSA-mq44-7p77-q5h7","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-mq44-7p77-q5h7"},{"rule_id":"osv/GHSA-494j-54xm-rwp3","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-494j-54xm-rwp3","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-494j-54xm-rwp3"},{"rule_id":"osv/GHSA-6cjc-53gc-5rqm","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-6cjc-53gc-5rqm","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-6cjc-53gc-5rqm"},{"rule_id":"osv/GHSA-f9xw-jh8m-3mwq","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-f9xw-jh8m-3mwq","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-f9xw-jh8m-3mwq"},{"rule_id":"osv/GHSA-pqxq-w44r-73xw","severity":"medium","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-pqxq-w44r-73xw","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-pqxq-w44r-73xw"},{"rule_id":"osv/GHSA-5p39-cfhj-2xmp","severity":"medium","message":"anyio@4.12.1 (PyPI) is affected by PYSEC-2026-4024, GHSA-5p39-cfhj-2xmp","path":"uv.lock","line":null,"fingerprint":"anyio@4.12.1 (PyPI):GHSA-5p39-cfhj-2xmp"},{"rule_id":"osv/GHSA-m959-cc7f-wv43","severity":"medium","message":"cryptography@46.0.4 (PyPI) is affected by PYSEC-2026-35, GHSA-m959-cc7f-wv43","path":"uv.lock","line":null,"fingerprint":"cryptography@46.0.4 (PyPI):GHSA-m959-cc7f-wv43"},{"rule_id":"osv/GHSA-m2h6-j472-rp4c","severity":"medium","message":"cryptography@46.0.4 (PyPI) is affected by PYSEC-2026-3554, GHSA-m2h6-j472-rp4c","path":"uv.lock","line":null,"fingerprint":"cryptography@46.0.4 (PyPI):GHSA-m2h6-j472-rp4c"},{"rule_id":"osv/GHSA-69hj-f68j-2879","severity":"medium","message":"filelock@3.25.2 (PyPI) is affected by GHSA-69hj-f68j-2879","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-69hj-f68j-2879"},{"rule_id":"osv/GHSA-8mx5-7m5m-r77g","severity":"medium","message":"filelock@3.25.2 (PyPI) is affected by GHSA-8mx5-7m5m-r77g","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-8mx5-7m5m-r77g"},{"rule_id":"osv/GHSA-cwqr-hh33-gh44","severity":"medium","message":"filelock@3.25.2 (PyPI) is affected by GHSA-cwqr-hh33-gh44","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-cwqr-hh33-gh44"},{"rule_id":"osv/GHSA-fq56-3cx3-fjxp","severity":"medium","message":"filelock@3.25.2 (PyPI) is affected by GHSA-fq56-3cx3-fjxp","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-fq56-3cx3-fjxp"},{"rule_id":"osv/GHSA-j8f7-rjxc-mr56","severity":"medium","message":"filelock@3.25.2 (PyPI) is affected by GHSA-j8f7-rjxc-mr56","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-j8f7-rjxc-mr56"},{"rule_id":"osv/GHSA-rfpc-qcw5-3pc4","severity":"medium","message":"filelock@3.25.2 (PyPI) is affected by GHSA-rfpc-qcw5-3pc4","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-rfpc-qcw5-3pc4"},{"rule_id":"osv/GHSA-65pc-fj4g-8rjx","severity":"medium","message":"idna@3.11 (PyPI) is affected by PYSEC-2026-215, GHSA-65pc-fj4g-8rjx","path":"uv.lock","line":null,"fingerprint":"idna@3.11 (PyPI):GHSA-65pc-fj4g-8rjx"},{"rule_id":"osv/GHSA-926x-3r5x-gfhw","severity":"medium","message":"langchain-core@1.2.9 (PyPI) is affected by PYSEC-2026-2563, GHSA-926x-3r5x-gfhw","path":"uv.lock","line":null,"fingerprint":"langchain-core@1.2.9 (PyPI):GHSA-926x-3r5x-gfhw"},{"rule_id":"osv/GHSA-fv5p-p927-qmxr","severity":"medium","message":"langchain-text-splitters@1.1.0 (PyPI) is affected by PYSEC-2026-77, GHSA-fv5p-p927-qmxr","path":"uv.lock","line":null,"fingerprint":"langchain-text-splitters@1.1.0 (PyPI):GHSA-fv5p-p927-qmxr"},{"rule_id":"osv/GHSA-rr7j-v2q5-chgv","severity":"medium","message":"langsmith@0.6.9 (PyPI) is affected by PYSEC-2026-2583, GHSA-rr7j-v2q5-chgv","path":"uv.lock","line":null,"fingerprint":"langsmith@0.6.9 (PyPI):GHSA-rr7j-v2q5-chgv"},{"rule_id":"osv/GHSA-xvg9-69gf-fjrf","severity":"medium","message":"mkdocs-material@9.7.1 (PyPI) is affected by PYSEC-2026-3864, GHSA-xvg9-69gf-fjrf","path":"uv.lock","line":null,"fingerprint":"mkdocs-material@9.7.1 (PyPI):GHSA-xvg9-69gf-fjrf"},{"rule_id":"osv/GHSA-54p9-h82j-f925","severity":"medium","message":"multidict@6.7.1 (PyPI) is affected by PYSEC-2026-4244, GHSA-54p9-h82j-f925","path":"uv.lock","line":null,"fingerprint":"multidict@6.7.1 (PyPI):GHSA-54p9-h82j-f925"},{"rule_id":"osv/GHSA-mf5v-w3w3-f6cg","severity":"medium","message":"opentelemetry-api@1.39.1 (PyPI) is affected by GHSA-mf5v-w3w3-f6cg","path":"uv.lock","line":null,"fingerprint":"opentelemetry-api@1.39.1 (PyPI):GHSA-mf5v-w3w3-f6cg"},{"rule_id":"osv/GHSA-xcq7-p3pf-p88h","severity":"medium","message":"opentelemetry-api@1.39.1 (PyPI) is affected by GHSA-xcq7-p3pf-p88h","path":"uv.lock","line":null,"fingerprint":"opentelemetry-api@1.39.1 (PyPI):GHSA-xcq7-p3pf-p88h"},{"rule_id":"osv/GHSA-wjx4-4jcj-g98j","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-wjx4-4jcj-g98j"},{"rule_id":"osv/GHSA-5xmw-vc9v-4wf2","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2251, GHSA-5xmw-vc9v-4wf2","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-5xmw-vc9v-4wf2"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-r73j-pqj5-w3x7","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-r73j-pqj5-w3x7"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-654x-cwwv-5j9c","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4336, GHSA-654x-cwwv-5j9c","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-654x-cwwv-5j9c"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@12.1.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"uv.lock","line":null,"fingerprint":"pillow@12.1.0 (PyPI):GHSA-wqgw-9xfh-qf2g"},{"rule_id":"osv/GHSA-62q4-447f-wv8h","severity":"medium","message":"pymdown-extensions@10.20.1 (PyPI) is affected by PYSEC-2026-2999, GHSA-62q4-447f-wv8h","path":"uv.lock","line":null,"fingerprint":"pymdown-extensions@10.20.1 (PyPI):GHSA-62q4-447f-wv8h"},{"rule_id":"osv/GHSA-9xwg-3r6f-jcx2","severity":"medium","message":"pymdown-extensions@10.20.1 (PyPI) is affected by PYSEC-2026-3609, GHSA-9xwg-3r6f-jcx2","path":"uv.lock","line":null,"fingerprint":"pymdown-extensions@10.20.1 (PyPI):GHSA-9xwg-3r6f-jcx2"},{"rule_id":"osv/GHSA-6w46-j5rx-g56g","severity":"medium","message":"pytest@9.0.2 (PyPI) is affected by PYSEC-2026-1845, GHSA-6w46-j5rx-g56g","path":"uv.lock","line":null,"fingerprint":"pytest@9.0.2 (PyPI):GHSA-6w46-j5rx-g56g"},{"rule_id":"osv/GHSA-mf9w-mj56-hr94","severity":"medium","message":"python-dotenv@1.2.1 (PyPI) is affected by PYSEC-2026-2270, GHSA-mf9w-mj56-hr94","path":"uv.lock","line":null,"fingerprint":"python-dotenv@1.2.1 (PyPI):GHSA-mf9w-mj56-hr94"},{"rule_id":"osv/GHSA-gc5v-m9x4-r6x2","severity":"medium","message":"requests@2.32.5 (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2","path":"uv.lock","line":null,"fingerprint":"requests@2.32.5 (PyPI):GHSA-gc5v-m9x4-r6x2"},{"rule_id":"osv/GHSA-h35f-9h28-mq5c","severity":"medium","message":"setuptools@80.10.2 (PyPI) is affected by PYSEC-2026-3447, GHSA-h35f-9h28-mq5c","path":"uv.lock","line":null,"fingerprint":"setuptools@80.10.2 (PyPI):GHSA-h35f-9h28-mq5c"},{"rule_id":"osv/GHSA-rrmf-rvhw-rf47","severity":"medium","message":"torch@2.10.0 (PyPI) is affected by GHSA-rrmf-rvhw-rf47","path":"uv.lock","line":null,"fingerprint":"torch@2.10.0 (PyPI):GHSA-rrmf-rvhw-rf47"},{"rule_id":"osv/GHSA-gh4c-6fx4-qh6g","severity":"medium","message":"urllib3@2.6.3 (PyPI) is affected by PYSEC-2026-4176, GHSA-gh4c-6fx4-qh6g","path":"uv.lock","line":null,"fingerprint":"urllib3@2.6.3 (PyPI):GHSA-gh4c-6fx4-qh6g"},{"rule_id":"osv/GHSA-9h9j-4vrj-gf7g","severity":"medium","message":"virtualenv@21.2.0 (PyPI) is affected by PYSEC-2026-4012, GHSA-9h9j-4vrj-gf7g","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-9h9j-4vrj-gf7g"},{"rule_id":"osv/GHSA-43mp-35q3-x3fq","severity":"medium","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-43mp-35q3-x3fq","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-43mp-35q3-x3fq"},{"rule_id":"osv/GHSA-558c-9hv2-4prj","severity":"medium","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-558c-9hv2-4prj","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-558c-9hv2-4prj"},{"rule_id":"osv/GHSA-cw65-gx24-rc82","severity":"medium","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-cw65-gx24-rc82","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-cw65-gx24-rc82"},{"rule_id":"osv/GHSA-fc2g-4w5p-6whm","severity":"medium","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-fc2g-4w5p-6whm","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-fc2g-4w5p-6whm"},{"rule_id":"osv/GHSA-hhxq-47xx-j5xx","severity":"medium","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-hhxq-47xx-j5xx","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-hhxq-47xx-j5xx"},{"rule_id":"osv/GHSA-gx76-c99x-2c96","severity":"low","message":"aiohttp@3.13.3 (PyPI) is affected by GHSA-gx76-c99x-2c96","path":"uv.lock","line":null,"fingerprint":"aiohttp@3.13.3 (PyPI):GHSA-gx76-c99x-2c96"},{"rule_id":"osv/GHSA-567q-5qvw-pf92","severity":"low","message":"filelock@3.25.2 (PyPI) is affected by GHSA-567q-5qvw-pf92","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-567q-5qvw-pf92"},{"rule_id":"osv/GHSA-9vhv-jxww-xfm5","severity":"low","message":"filelock@3.25.2 (PyPI) is affected by GHSA-9vhv-jxww-xfm5","path":"uv.lock","line":null,"fingerprint":"filelock@3.25.2 (PyPI):GHSA-9vhv-jxww-xfm5"},{"rule_id":"osv/GHSA-2g6r-c272-w58r","severity":"low","message":"langchain-core@1.2.9 (PyPI) is affected by PYSEC-2026-2562, GHSA-2g6r-c272-w58r","path":"uv.lock","line":null,"fingerprint":"langchain-core@1.2.9 (PyPI):GHSA-2g6r-c272-w58r"},{"rule_id":"osv/GHSA-5239-wwwm-4pmq","severity":"low","message":"pygments@2.19.2 (PyPI) is affected by PYSEC-2026-2987, GHSA-5239-wwwm-4pmq","path":"uv.lock","line":null,"fingerprint":"pygments@2.19.2 (PyPI):GHSA-5239-wwwm-4pmq"},{"rule_id":"osv/GHSA-xmj3-9gf7-h52w","severity":"low","message":"setuptools@80.10.2 (PyPI) is affected by GHSA-xmj3-9gf7-h52w","path":"uv.lock","line":null,"fingerprint":"setuptools@80.10.2 (PyPI):GHSA-xmj3-9gf7-h52w"},{"rule_id":"osv/GHSA-494p-63j8-28p3","severity":"low","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-494p-63j8-28p3","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-494p-63j8-28p3"},{"rule_id":"osv/GHSA-cx28-75q4-x26q","severity":"low","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-cx28-75q4-x26q","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-cx28-75q4-x26q"},{"rule_id":"osv/GHSA-qmx5-4p3x-wvqf","severity":"low","message":"virtualenv@21.2.0 (PyPI) is affected by GHSA-qmx5-4p3x-wvqf","path":"uv.lock","line":null,"fingerprint":"virtualenv@21.2.0 (PyPI):GHSA-qmx5-4p3x-wvqf"}],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":10.0,"findings":62.0,"findings_high":43.0,"findings_medium":0.0,"findings_low":19.0,"penalty":496.1},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/codex-macos.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/codex-macos.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/codex-macos.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/codex-macos.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/codex-macos.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/codex-macos.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dsh-windows.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/dsh-windows.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dsh-windows.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/dsh-windows.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dsh-windows.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/dsh-windows.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dsh-windows.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/dsh-windows.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/opencode-windows.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/opencode-windows.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/opencode-windows.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/opencode-windows.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/opencode-windows.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/opencode-windows.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release-drafter.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/release-drafter.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release-dsh.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/release-dsh.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release-dsh.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/release-dsh.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/release.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/release.yml:40"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/release.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":51,"fingerprint":"unpinned-uses:.github/workflows/release.yml:51"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":54,"fingerprint":"unpinned-uses:.github/workflows/release.yml:54"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":77,"fingerprint":"unpinned-uses:.github/workflows/release.yml:77"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":80,"fingerprint":"unpinned-uses:.github/workflows/release.yml:80"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":111,"fingerprint":"unpinned-uses:.github/workflows/release.yml:111"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":115,"fingerprint":"unpinned-uses:.github/workflows/release.yml:115"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":40,"fingerprint":"cache-poisoning:.github/workflows/release.yml:40"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":80,"fingerprint":"cache-poisoning:.github/workflows/release.yml:80"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":111,"fingerprint":"cache-poisoning:.github/workflows/release.yml:111"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/stale.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/stale.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/test.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/test.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/test.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/test.yml:47"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":50,"fingerprint":"unpinned-uses:.github/workflows/test.yml:50"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":55,"fingerprint":"unpinned-uses:.github/workflows/test.yml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":58,"fingerprint":"unpinned-uses:.github/workflows/test.yml:58"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":91,"fingerprint":"unpinned-uses:.github/workflows/test.yml:91"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":94,"fingerprint":"unpinned-uses:.github/workflows/test.yml:94"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":105,"fingerprint":"unpinned-uses:.github/workflows/test.yml:105"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":108,"fingerprint":"unpinned-uses:.github/workflows/test.yml:108"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/codex-macos.yml","line":26,"fingerprint":"artipacked:.github/workflows/codex-macos.yml:26"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docs.yml","line":23,"fingerprint":"artipacked:.github/workflows/docs.yml:23"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dsh-windows.yml","line":24,"fingerprint":"artipacked:.github/workflows/dsh-windows.yml:24"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/lint.yml","line":18,"fingerprint":"artipacked:.github/workflows/lint.yml:18"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/opencode-windows.yml","line":18,"fingerprint":"artipacked:.github/workflows/opencode-windows.yml:18"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release-dsh.yml","line":26,"fingerprint":"artipacked:.github/workflows/release-dsh.yml:26"},{"rule_id":"zizmor/adhoc-packages","severity":"low","message":"ad-hoc installation of packages [confidence high]","path":".github/workflows/release-dsh.yml","line":38,"fingerprint":"adhoc-packages:.github/workflows/release-dsh.yml:38"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":36,"fingerprint":"artipacked:.github/workflows/release.yml:36"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":76,"fingerprint":"artipacked:.github/workflows/release.yml:76"},{"rule_id":"zizmor/adhoc-packages","severity":"low","message":"ad-hoc installation of packages [confidence high]","path":".github/workflows/release.yml","line":87,"fingerprint":"adhoc-packages:.github/workflows/release.yml:87"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":22,"fingerprint":"artipacked:.github/workflows/test.yml:22"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":46,"fingerprint":"artipacked:.github/workflows/test.yml:46"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":90,"fingerprint":"artipacked:.github/workflows/test.yml:90"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release-dsh.yml","line":51,"fingerprint":"template-injection:.github/workflows/release-dsh.yml:51"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release-dsh.yml","line":52,"fingerprint":"template-injection:.github/workflows/release-dsh.yml:52"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release-dsh.yml","line":59,"fingerprint":"template-injection:.github/workflows/release-dsh.yml:59"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release-dsh.yml","line":59,"fingerprint":"template-injection:.github/workflows/release-dsh.yml:59"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":99,"fingerprint":"template-injection:.github/workflows/release.yml:99"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":99,"fingerprint":"template-injection:.github/workflows/release.yml:99"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.925,"unpinned_manifests":3.0},"findings":[],"evidence":[{"kind":"posture","description":"plugins/dsh/package.json has no lockfile alongside it (unpinned dependencies)","ref":"plugins/dsh/package.json","url":null,"weight":0.3},{"kind":"posture","description":"plugins/openclaw/package.json has no lockfile alongside it (unpinned dependencies)","ref":"plugins/openclaw/package.json","url":null,"weight":0.3},{"kind":"posture","description":"plugins/opencode/package.json has no lockfile alongside it (unpinned dependencies)","ref":"plugins/opencode/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":832.0,"function_nloc":11592.0,"mean_ccn":4.32,"p90_ccn":10.0,"complex_functions":28.0,"long_functions":4.0,"many_param_functions":8.0,"risky_nloc_share":0.1745},"findings":[],"evidence":[{"kind":"complex-function","description":"main in evaluation/rerank_evaluate.py: complexity 52, 172 lines","ref":"evaluation/rerank_evaluate.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/evaluation/rerank_evaluate.py#L77","weight":0.8666666666666667},{"kind":"complex-function","description":"renderMarkdown in plugins/dsh/client.js: complexity 30, 86 lines","ref":"plugins/dsh/client.js","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/dsh/client.js#L162","weight":0.5},{"kind":"complex-function","description":"status in plugins/opencode/scripts/opencode_turns.py: complexity 29, 36 lines","ref":"plugins/opencode/scripts/opencode_turns.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/opencode/scripts/opencode_turns.py#L135","weight":0.48333333333333334},{"kind":"complex-function","description":"_parse_workbuddy in src/memsearch/transcript.py: complexity 29, 43 lines","ref":"src/memsearch/transcript.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/src/memsearch/transcript.py#L235","weight":0.48333333333333334},{"kind":"complex-function","description":"read in plugins/openclaw/index.js: complexity 28, 54 lines","ref":"plugins/openclaw/index.js","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/openclaw/index.js#L295","weight":0.4666666666666667},{"kind":"complex-function","description":"read in plugins/openclaw/index.ts: complexity 28, 54 lines","ref":"plugins/openclaw/index.ts","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/openclaw/index.ts#L394","weight":0.4666666666666667},{"kind":"complex-function","description":"capture_batch in plugins/opencode/scripts/capture.py: complexity 26, 77 lines","ref":"plugins/opencode/scripts/capture.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/opencode/scripts/capture.py#L274","weight":0.43333333333333335},{"kind":"complex-function","description":"_parse_task_response in src/memsearch/maintenance.py: complexity 26, 65 lines","ref":"src/memsearch/maintenance.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/src/memsearch/maintenance.py#L574","weight":0.43333333333333335},{"kind":"complex-function","description":"parse_transcript in plugins/claude-code/transcript.py: complexity 25, 65 lines","ref":"plugins/claude-code/transcript.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/transcript.py#L22","weight":0.4166666666666667},{"kind":"complex-function","description":"_parse_claude in src/memsearch/transcript.py: complexity 23, 36 lines","ref":"src/memsearch/transcript.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/src/memsearch/transcript.py#L107","weight":0.38333333333333336}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":15460.0,"duplicated_lines":3650.0,"duplicated_share":0.2361,"files":80.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/_shared/scripts/maintenance-runner.py:1 and plugins/claude-code/scripts/maintenance-runner.py:1","ref":"plugins/_shared/scripts/maintenance-runner.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/_shared/scripts/maintenance-runner.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/_shared/scripts/maintenance-runner.py:288 and plugins/_shared/scripts/maintenance-runner.py:302","ref":"plugins/_shared/scripts/maintenance-runner.py","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/_shared/scripts/maintenance-runner.py#L288","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/hooks/common.sh:19 and plugins/codex/hooks/common.sh:13","ref":"plugins/claude-code/hooks/common.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/hooks/common.sh#L19","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/hooks/parse-transcript.sh:88 and plugins/claude-code/transcript.py:87","ref":"plugins/claude-code/hooks/parse-transcript.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/hooks/parse-transcript.sh#L88","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/hooks/parse-transcript.sh:111 and plugins/codex/scripts/parse-rollout.sh:326","ref":"plugins/claude-code/hooks/parse-transcript.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/hooks/parse-transcript.sh#L111","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/hooks/session-start.sh:23 and plugins/codex/hooks/session-start.sh:11","ref":"plugins/claude-code/hooks/session-start.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/hooks/session-start.sh#L23","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/hooks/session-start.sh:78 and plugins/claude-code/hooks/stop.sh:21","ref":"plugins/claude-code/hooks/session-start.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/hooks/session-start.sh#L78","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/hooks/stop.sh:7 and plugins/codex/hooks/stop.sh:228","ref":"plugins/claude-code/hooks/stop.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/hooks/stop.sh#L7","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/hooks/user-prompt-submit.sh:5 and plugins/codex/hooks/user-prompt-submit.sh:5","ref":"plugins/claude-code/hooks/user-prompt-submit.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/hooks/user-prompt-submit.sh#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/claude-code/scripts/derive-collection.sh:25 and plugins/codex/scripts/derive-collection.sh:18","ref":"plugins/claude-code/scripts/derive-collection.sh","url":"https://github.com/zilliztech/memsearch/blob/3e296a379cbd4605debde8571b2c7f61f27399a5/plugins/claude-code/scripts/derive-collection.sh#L25","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":32.0,"weighted_findings":47.75,"scanned_lines":20178.0,"category:best-practice":3.0,"category:correctness":24.0,"category:maintainability":5.0},"findings":[{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'file.name' is used. Use '.flush()' or close the file before using 'file.name'.","path":"evaluation/rerank_evaluate.py","line":189,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:evaluation/rerank_evaluate.py:189"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'output_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'output_file.name' is used. Use '.flush()' or close the file before using 'output_file.name'.","path":"plugins/_shared/scripts/maintenance-runner.py","line":217,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:plugins/_shared/scripts/maintenance-runner.py:217"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'output_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'output_file.name' is used. Use '.flush()' or close the file before using 'output_file.name'.","path":"plugins/claude-code/scripts/maintenance-runner.py","line":217,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:plugins/claude-code/scripts/maintenance-runner.py:217"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'output_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'output_file.name' is used. Use '.flush()' or close the file before using 'output_file.name'.","path":"plugins/codex/scripts/maintenance-runner.py","line":217,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:plugins/codex/scripts/maintenance-runner.py:217"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'output_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'output_file.name' is used. Use '.flush()' or close the file before using 'output_file.name'.","path":"plugins/dsh/scripts/maintenance-runner.py","line":217,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:plugins/dsh/scripts/maintenance-runner.py:217"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'output_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'output_file.name' is used. Use '.flush()' or close the file before using 'output_file.name'.","path":"plugins/openclaw/scripts/maintenance-runner.py","line":217,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:plugins/openclaw/scripts/maintenance-runner.py:217"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"plugins/opencode/scripts/capture.py","line":47,"fingerprint":"python.lang.best-practice.arbitrary-sleep:plugins/opencode/scripts/capture.py:47"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'output_file.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'output_file.name' is used. Use '.flush()' or close the file before using 'output_file.name'.","path":"plugins/opencode/scripts/maintenance-runner.py","line":217,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:plugins/opencode/scripts/maintenance-runner.py:217"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"src/memsearch/cli.py","line":715,"fingerprint":"python.lang.best-practice.arbitrary-sleep:src/memsearch/cli.py:715"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"plugins/dsh/client.js","line":31,"fingerprint":"javascript.lang.best-practice.lazy-load-module:plugins/dsh/client.js:31"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1015,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1015"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1017,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1017"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1085,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1085"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1085,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1085"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1085,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1085"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1085,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1085"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1085,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1085"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1085,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1085"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/dsh/index.js","line":1085,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/dsh/index.js:1085"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"plugins/openclaw/scripts/session-sdk-contract.mjs","line":93,"fingerprint":"javascript.lang.correctness.no-stringify-keys:plugins/openclaw/scripts/session-sdk-contract.mjs:93"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"plugins/openclaw/scripts/session-sdk-contract.mjs","line":114,"fingerprint":"javascript.lang.correctness.no-stringify-keys:plugins/openclaw/scripts/session-sdk-contract.mjs:114"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"plugins/openclaw/scripts/session-sdk-contract.mjs","line":115,"fingerprint":"javascript.lang.correctness.no-stringify-keys:plugins/openclaw/scripts/session-sdk-contract.mjs:115"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"plugins/openclaw/scripts/session-sdk-contract.mjs","line":162,"fingerprint":"javascript.lang.correctness.no-stringify-keys:plugins/openclaw/scripts/session-sdk-contract.mjs:162"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"plugins/opencode/derive-collection.ts","line":28,"fingerprint":"javascript.lang.correctness.no-replaceall:plugins/opencode/derive-collection.ts:28"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"src/memsearch/config.py","line":188,"fingerprint":"python.lang.maintainability.return-not-in-function:src/memsearch/config.py:188"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"src/memsearch/config.py","line":191,"fingerprint":"python.lang.maintainability.return-not-in-function:src/memsearch/config.py:191"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_directory\" a function or an attribute? If it is a function, you may have meant event.is_directory() because event.is_directory is always true.","path":"src/memsearch/watcher.py","line":60,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/memsearch/watcher.py:60"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_directory\" a function or an attribute? If it is a function, you may have meant event.is_directory() because event.is_directory is always true.","path":"src/memsearch/watcher.py","line":64,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/memsearch/watcher.py:64"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_directory\" a function or an attribute? If it is a function, you may have meant event.is_directory() because event.is_directory is always true.","path":"src/memsearch/watcher.py","line":68,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/memsearch/watcher.py:68"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"plugins/claude-code/hooks/stop.sh","line":184,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:plugins/claude-code/hooks/stop.sh:184"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/dsh/index.js","line":1017,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/dsh/index.js:1017"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/dsh/index.js","line":1017,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/dsh/index.js:1017"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":17399.0,"source_lines":20178.0,"test_ratio":0.8623,"ci_files":10.0,"cochange_share":0.6624,"cochange_commits":157.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/codex-macos.yml","ref":".github/workflows/codex-macos.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/docs.yml","ref":".github/workflows/docs.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/dsh-windows.yml","ref":".github/workflows/dsh-windows.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/lint.yml","ref":".github/workflows/lint.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/opencode-windows.yml","ref":".github/workflows/opencode-windows.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release-drafter.yml","ref":".github/workflows/release-drafter.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release-dsh.yml","ref":".github/workflows/release-dsh.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/stale.yml","ref":".github/workflows/stale.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest, npm test, npm run test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest","npm test","npm run test"],"lint_commands":["ruff"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":511.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.1402,"check:low_escape_density":0.0,"escapes":173.0,"escapes_per_kloc":13.239},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: plugins/opencode/tsconfig.json","ref":"plugins/opencode/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":5403.0,"other_lines":14775.0,"files_blamed":80.0,"blame_failures":0.0,"quality:ai_findings":13.0,"quality:ai_per_kloc":2.406,"quality:other_findings":19.0,"quality:other_per_kloc":1.286,"quality:ratio":1.87,"security:ai_findings":21.0,"security:ai_per_kloc":3.887,"security:other_findings":14.0,"security:other_per_kloc":0.948,"security:ratio":4.1},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}