{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:22:29.900246Z","repo":{"ref":{"host":"github.com","owner":"zxh0","name":"jvm.go"},"default_branch":"master","clone_url":"https://github.com/zxh0/jvm.go.git","html_url":"https://github.com/zxh0/jvm.go","description":"A toy JVM written in Go","stars":3596,"forks":463,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":4346,"primary_language":"Go","license_spdx":"MIT","created_at":"2015-01-07T08:46:46Z","pushed_at":"2019-12-04T14:16:37Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-09-21T12:43:20Z","owner_type":"User","release_assets":[]}},"commit_sha":"129b147ebcc820279748f6095c916da1986ebef1","profile":{"lines_by_language":{"Go":15352,"Java":3449,"Shell":16},"files_by_category":{"source":235,"test":113,"other":6,"docs":5,"binary":5,"config":2,"generated":1,"oversized":1},"source_lines":14580,"test_lines":4237},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":69.4,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":84.0,"duplication":88.6,"lint":96.6,"testing":59.5,"docs":65.0,"type_safety":null,"process":0.0},"summary":"Code quality is adequate: test-to-source ratio 0.29, no CI test run detected; 6% of function code in complex or long functions; 2% duplicated lines. Weakest area: process."},"security":{"score":74.2,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":91.4,"dependencies":87.5,"ci_actions":null,"posture":0.0,"scorecard":22.5},"summary":"Security posture is adequate: 3 known vulnerabilities in 1 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":1.9,"check:Code-Review":0.0,"check:Maintained":0.0,"check:SAST":0.0,"check:Binary-Artifacts":9.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:License":10.0,"check:Fuzzing":0.0,"check:Branch-Protection":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 0/10 (Found 0/30 approved changesets -- score normalized to 0)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (no SAST tool detected)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 9/10 (binaries present in source code)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":0.1},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/zxh0/jvm.go","weight":1.0}],"data":{"date":"2026-11-09","commit":"129b147ebcc820279748f6095c916da1986ebef1","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":2062.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":60808.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2015-01":{"loc":12979,"attributed_loc":0},"2015-02":{"loc":16140,"attributed_loc":0},"2015-03":{"loc":9635,"attributed_loc":0},"2015-04":{"loc":1997,"attributed_loc":0},"2015-05":{"loc":783,"attributed_loc":0},"2015-11":{"loc":1984,"attributed_loc":0},"2015-12":{"loc":627,"attributed_loc":0},"2017-03":{"loc":3,"attributed_loc":0},"2017-11":{"loc":10,"attributed_loc":0},"2018-01":{"loc":0,"attributed_loc":0},"2018-04":{"loc":0,"attributed_loc":0},"2018-10":{"loc":0,"attributed_loc":0},"2018-12":{"loc":4,"attributed_loc":0},"2019-04":{"loc":0,"attributed_loc":0},"2019-05":{"loc":536,"attributed_loc":0},"2019-07":{"loc":271,"attributed_loc":0},"2019-09":{"loc":6826,"attributed_loc":0},"2019-10":{"loc":8563,"attributed_loc":0},"2019-11":{"loc":439,"attributed_loc":0},"2019-12":{"loc":11,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":441.0,"flagged_units":0.0,"pre_ai_era_bursts":2.0,"pre_ai_era_measured_loc":60808.0,"pre_ai_era_burst_loc":7497.0,"measured_loc":60808.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":2448.8641234462066,"median_loc_per_hour":49.40253878700865,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":14580.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":15.0,"findings_high":0.0,"findings_medium":15.0,"findings_low":0.0,"weighted_findings":3.75,"scanned_lines":14580.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"native/java/lang/Object.go","line":45,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:native/java/lang/Object.go:45"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"native/java/lang/System.go","line":84,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:native/java/lang/System.go:84"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"native/sun/misc/Unsafe_cas.go","line":99,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:native/sun/misc/Unsafe_cas.go:99"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"native/sun/misc/Unsafe_cas.go","line":102,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:native/sun/misc/Unsafe_cas.go:102"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"native/sun/misc/Unsafe_cas.go","line":103,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:native/sun/misc/Unsafe_cas.go:103"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"rtda/class_initialization.go","line":17,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:rtda/class_initialization.go:17"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/native_endian.go","line":15,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/native_endian.go:15"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/native_endian.go","line":20,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/native_endian.go:20"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/native_endian.go","line":25,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/native_endian.go:25"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/unsafe.go","line":10,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/unsafe.go:10"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/unsafe.go","line":14,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/unsafe.go:14"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/unsafe.go","line":20,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/unsafe.go:20"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/unsafe.go","line":25,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/unsafe.go:25"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/unsafe.go","line":31,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/unsafe.go:31"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"vmutils/unsafe.go","line":37,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:vmutils/unsafe.go:37"}],"evidence":[],"data":{"rulesets":["go"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":1.0,"vulnerabilities":3.0,"vulns_critical":0.0,"vulns_high":1.0,"vulns_medium":2.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":8.0},"findings":[{"rule_id":"osv/GHSA-6q6q-88xp-6f2r","severity":"high","message":"gopkg.in/yaml.v2@2.2.2 (Go) is affected by GO-2022-0956, GHSA-6q6q-88xp-6f2r","path":"go.sum","line":null,"fingerprint":"gopkg.in/yaml.v2@2.2.2 (Go):GHSA-6q6q-88xp-6f2r"},{"rule_id":"osv/GHSA-wxc4-f4m6-wwqv","severity":"medium","message":"gopkg.in/yaml.v2@2.2.2 (Go) is affected by GO-2020-0036, GHSA-wxc4-f4m6-wwqv","path":"go.sum","line":null,"fingerprint":"gopkg.in/yaml.v2@2.2.2 (Go):GHSA-wxc4-f4m6-wwqv"},{"rule_id":"osv/GHSA-r88r-gmrh-7j83","severity":"medium","message":"gopkg.in/yaml.v2@2.2.2 (Go) is affected by GO-2021-0061, GHSA-r88r-gmrh-7j83","path":"go.sum","line":null,"fingerprint":"gopkg.in/yaml.v2@2.2.2 (Go):GHSA-r88r-gmrh-7j83"}],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.015,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1281.0,"function_nloc":8596.0,"mean_ccn":1.92,"p90_ccn":3.0,"complex_functions":3.0,"long_functions":1.0,"many_param_functions":0.0,"risky_nloc_share":0.0583},"findings":[],"evidence":[{"kind":"complex-function","description":"newInstruction in instructions/factory.go: complexity 205, 414 lines","ref":"instructions/factory.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/instructions/factory.go#L172","weight":1.0},{"kind":"complex-function","description":"readConstantInfo in classfile/constant_info.go: complexity 17, 39 lines","ref":"classfile/constant_info.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/classfile/constant_info.go#L36","weight":0.2833333333333333},{"kind":"complex-function","description":"describeModule in cmd/jmod/main.go: complexity 16, 48 lines","ref":"cmd/jmod/main.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/cmd/jmod/main.go#L70","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":9744.0,"duplicated_lines":196.0,"duplicated_share":0.0201,"files":235.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/javap/main.go:140 and cmd/javap/main.go:171","ref":"cmd/javap/main.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/cmd/javap/main.go#L140","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cpu/loop.go:32 and cpu/loop.go:70","ref":"cpu/loop.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/cpu/loop.go#L32","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: instructions/comparisons/cmp.go:39 and instructions/comparisons/cmp.go:62","ref":"instructions/comparisons/cmp.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/instructions/comparisons/cmp.go#L39","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: instructions/loads/aload.go:25 and instructions/stores/astore.go:27","ref":"instructions/loads/aload.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/instructions/loads/aload.go#L25","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: instructions/references/getstatic.go:16 and instructions/references/putstatic.go:16","ref":"instructions/references/getstatic.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/instructions/references/getstatic.go#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: instructions/references/monitor.go:12 and instructions/references/monitor.go:26","ref":"instructions/references/monitor.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/instructions/references/monitor.go#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/java/io/FileInputStream.go:61 and native/java/io/RandomAccessFile.go:104","ref":"native/java/io/FileInputStream.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/native/java/io/FileInputStream.go#L61","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/java/lang/reflect/Array.go:28 and native/java/lang/reflect/Array.go:80","ref":"native/java/lang/reflect/Array.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/native/java/lang/reflect/Array.go#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/java/lang/reflect/Proxy.go:40 and native/sun/misc/Unsafe_class.go:40","ref":"native/java/lang/reflect/Proxy.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/native/java/lang/reflect/Proxy.go#L40","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/java/net/PlainSocketImpl.go:78 and native/sun/nio/ch/Net.go:71","ref":"native/java/net/PlainSocketImpl.go","url":"https://github.com/zxh0/jvm.go/blob/129b147ebcc820279748f6095c916da1986ebef1/native/java/net/PlainSocketImpl.go#L78","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5.0,"weighted_findings":2.0,"scanned_lines":14580.0,"category:correctness":5.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"native/java/io/RandomAccessFile.go","line":54,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:native/java/io/RandomAccessFile.go:54"},{"rule_id":"opengrep/go.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected useless comparison operation `frame.PopInt() == frame.PopInt()` or `frame.PopInt() != frame.PopInt()`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.","path":"instructions/comparisons/if.go","line":35,"fingerprint":"go.lang.correctness.eqeq-is-bad:instructions/comparisons/if.go:35"},{"rule_id":"opengrep/go.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected useless comparison operation `frame.PopInt() == frame.PopInt()` or `frame.PopInt() != frame.PopInt()`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.","path":"instructions/comparisons/if.go","line":36,"fingerprint":"go.lang.correctness.eqeq-is-bad:instructions/comparisons/if.go:36"},{"rule_id":"opengrep/go.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected useless comparison operation `frame.PopRef() == frame.PopRef()` or `frame.PopRef() != frame.PopRef()`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.","path":"instructions/comparisons/if.go","line":41,"fingerprint":"go.lang.correctness.eqeq-is-bad:instructions/comparisons/if.go:41"},{"rule_id":"opengrep/go.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected useless comparison operation `frame.PopRef() == frame.PopRef()` or `frame.PopRef() != frame.PopRef()`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression that is not deterministic.","path":"instructions/comparisons/if.go","line":42,"fingerprint":"go.lang.correctness.eqeq-is-bad:instructions/comparisons/if.go:42"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.5812,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":4237.0,"source_lines":14580.0,"test_ratio":0.2906,"ci_files":1.0,"cochange_share":0.2548,"cochange_commits":259.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":27.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}