Leaderboard github.com
666ghj/MiroFish
A Simple and Universal Swarm Intelligence Engine, Predicting Anything. 简洁通用的群体智能引擎，预测万物
AI provenance
10%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
51/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
53/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
10% explicit
Explicit AI attribution on 10% of first-party code added; an estimated 10% including velocity signals.
How the score is built
- Explicitly attributed share10%
- Unattributed share in AI-pace bursts48%
- Estimated AI-generated share10%
- AI tool configuration files0
- Work sessions at AI pace14
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.53
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| OpenAI Codex | 7 | 6,672 | 2026-07-22 | 2026-08-03 |
| Cursor agent | 1 | 0 | 2025-12-30 | 2025-12-30 |
Lines added per month all AI-attributed share
- 2025-114,533 · 0% AI
- 2025-1245,009 · 0% AI
- 2026-011,348 · 0% AI
- 2026-021,248 · 0% AI
- 2026-03169 · 0% AI
- 2026-041,749 · 0% AI
- 2026-0523 · 0% AI
- 2026-0710,308 · 63% AI
- 2026-08142 · 100% AI
- 2026-090 · 0% AI
- 2026-100 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 3,538 lines trace to AI-attributed commits, 43,335 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 5.37 | 1.15 | 4.65× |
| Security | 0.00 | 0.18 | 0.00× |
Evidence by analyzer
Explicit AI attributionok10 items
- OpenAI Codex: 7 attributed commits, 6,672 lines added
- Cursor agent: 1 attributed commits, 0 lines added
- OpenAI Codex: PR branch 'codex/star-history-manual-merge'
- OpenAI Codex: PR branch 'codex/star-history-pr-mode'
- OpenAI Codex: on merged branch (60757b3c82)
- OpenAI Codex: on merged branch (d64175943e)
- OpenAI Codex: on merged branch (d64175943e)
- OpenAI Codex: on merged branch (d64175943e)
- OpenAI Codex: on merged branch (d64175943e)
- Cursor agent: author email [email protected]
- attributed_commit_share
- 2.7%
- attributed_commits
- 8
- attributed_loc
- 6,672
- attributed_loc_share
- 10.3%
- commits
- 299
- effective_loc
- 64,529
- tools_detected
- 2
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok14 items
- 4,752 lines of first-party code in ~2.6h (1,856 lines/hour, 1 commit session)
- 1,564 lines of first-party code in ~1.1h (1,474 lines/hour, 1 commit session)
- 5,801 lines of first-party code in ~4.0h (1,450 lines/hour, 1 commit session)
- 4,635 lines of first-party code in ~4.1h (1,121 lines/hour, 11 commit session)
- 1,094 lines of first-party code in ~1.1h (1,019 lines/hour, 1 commit session)
- 1,554 lines of first-party code in ~1.8h (863 lines/hour, 3 commit session)
- 2,309 lines of first-party code in ~2.8h (835 lines/hour, 3 commit session)
- 1,943 lines of first-party code in ~2.3h (834 lines/hour, 5 commit session)
- 1,687 lines of first-party code in ~2.2h (776 lines/hour, 1 commit session)
- 1,701 lines of first-party code in ~2.2h (763 lines/hour, 2 commit session)
- 2,829 lines of first-party code in ~4.0h (707 lines/hour, 1 commit session)
- 2,755 lines of first-party code in ~4.0h (689 lines/hour, 1 commit session)
- 2,602 lines of first-party code in ~4.2h (617 lines/hour, 2 commit session)
- 1,285 lines of first-party code in ~2.4h (535 lines/hour, 4 commit session)
- excluded_import_loc
- 2,568
- flagged_loc
- 36,511
- flagged_loc_share
- 58.9%
- flagged_units
- 14
- max_loc_per_hour
- 1,856.05
- measured_loc
- 61,961
- median_loc_per_hour
- 205.92
- pr_timed_units
- 2
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 100
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 74.40
- releases
- 2
Coding styleok8 items
- step-by-step narration comment: # Step 1: 使用LLM生成子问题
- step-by-step narration comment: # Step 2: 对每个子问题进行语义搜索
- step-by-step narration comment: # Step 3: 从边中提取相关实体UUID，只获取这些实体的信息（不获取全部节点）
- step-by-step narration comment: # Step 4: 构建所有关系链（不限制数量）
- step-by-step narration comment: # Step 1: 读取人设文件
- step-by-step narration comment: # Step 2: 使用LLM选择要采访的Agent（返回agent_id列表）
- step-by-step narration comment: # Step 3: 生成采访问题（如果没有提供）
- step-by-step narration comment: # Step 4: 调用真实的采访API（不指定platform，默认双平台同时采访）
- count:assistant_voice
- 0
- count:emoji_in_code
- 30
- count:narrated_steps
- 10
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 3
- files:narrated_steps
- 1
- files:placeholder
- 0
- index
- 0.53
- lines_scanned
- 46,873
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.64
- per_kloc:narrated_steps
- 0.21
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 3,538
- blame_failures
- 0
- files_blamed
- 66
- other_lines
- 43,335
- quality:ai_findings
- 19
- quality:ai_per_kloc
- 5.37
- quality:other_findings
- 50
- quality:other_per_kloc
- 1.15
- quality:ratio
- 4.65
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 8
- security:other_per_kloc
- 0.18
- security:ratio
- 0
Code quality
51 weak
Code quality is weak: test-to-source ratio 0.10, CI runs tests; 29% of function code in complex or long functions; 15% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity42
- Duplication41
- Lint and smells62
- Tests and CI63
- Documentation65
- Type safety0
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- run in backend/scripts/validate_zep_cloud_integration.py: complexity 65, 329 lines
- _validate_svg in scripts/star_history.py: complexity 50, 217 lines
- _validate_and_process in backend/app/services/ontology_generator.py: complexity 40, 149 lines
- start_simulation in backend/app/api/simulation.py: complexity 37, 211 lines
- _build_graph_impl in backend/app/api/graph.py: complexity 35, 158 lines
- validate_state in scripts/star_history.py: complexity 35, 97 lines
- generate_report in backend/app/api/report.py: complexity 33, 190 lines
- _generate_section_react in backend/app/services/report_agent.py: complexity 31, 231 lines
- run_reddit_simulation in backend/scripts/run_parallel_simulation.py: complexity 31, 135 lines
- _enrich_action_context in backend/scripts/run_parallel_simulation.py: complexity 30, 76 lines
- complex_functions
- 45
- function_nloc
- 18,533
- functions
- 1,028
- long_functions
- 25
- many_param_functions
- 8
- mean_ccn
- 4.32
- p90_ccn
- 10
- risky_nloc_share
- 29.1%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: backend/app/api/graph.py:137 and backend/app/api/graph.py:176
- 6+ duplicated lines: backend/app/api/graph.py:851 and backend/app/api/report.py:375
- 6+ duplicated lines: backend/app/api/report.py:57 and backend/app/api/simulation.py:435
- 6+ duplicated lines: backend/app/api/report.py:75 and backend/app/api/report.py:638
- 6+ duplicated lines: backend/app/api/simulation.py:662 and backend/app/api/simulation.py:1048
- 6+ duplicated lines: backend/app/services/graph_builder.py:498 and backend/app/services/graph_builder.py:522
- 6+ duplicated lines: backend/app/services/oasis_profile_generator.py:125 and backend/app/services/oasis_profile_generator.py:153
- 6+ duplicated lines: backend/app/services/oasis_profile_generator.py:251 and backend/app/services/simulation_config_generator.py:232
- 6+ duplicated lines: backend/app/services/ontology_generator.py:660 and backend/app/services/ontology_generator.py:688
- 6+ duplicated lines: backend/app/services/report_agent.py:178 and backend/app/services/report_agent.py:200
- compared_lines
- 34,976
- duplicated_lines
- 5,231
- duplicated_share
- 15.0%
- files
- 66
Lintok
- category:best-practice
- 20
- category:correctness
- 34
- category:maintainability
- 15
- findings
- 69
- scanned_lines
- 46,873
- weighted_findings
- 88.25
Tests and CIok3 items
- CI config: .github/workflows/docker-image.yml
.github/workflows/docker-image.yml - CI config: .github/workflows/update-star-history.yml
.github/workflows/update-star-history.yml - CI runs tests (unittest)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 2
- cochange_commits
- 214
- cochange_share
- 7.5%
- source_lines
- 46,873
- test_lines
- 4,810
- test_ratio
- 0.10
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 140
Type safetyok
- check:low_escape_density
- no
- check:strict_config
- no
- escapes
- 261
- escapes_per_kloc
- 10.08
Security
53 weak
Security posture is weak: 332 known vulnerabilities in 49 dependencies; 4 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.
How the score is built
- Secrets97
- Static analysis (SAST)96
- Vulnerable dependencies0
- CI workflows30
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 23
- declared
- 23
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 1
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 9
- findings_high
- 4
- findings_low
- 1
- findings_medium
- 4
- parse_errors
- 0
- scanned_lines
- 46,873
- weighted_findings
- 5.11
Dependencies (osv-scanner)ok
- penalty
- 380
- vulnerabilities
- 332
- vulnerable_packages
- 49
- vulns_critical
- 16
- vulns_high
- 151
- vulns_low
- 21
- vulns_medium
- 142
- vulns_unknown
- 2
CI workflows (zizmor)ok
- findings
- 7
- findings_high
- 6
- findings_low
- 0
- findings_medium
- 1
- penalty
- 73.20
- workflows
- 2
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 7.5%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
16 critical171 high196 medium3 low
386 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-332p-7hrc-92wf |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf | Dependencies (osv-scanner) |
| critical | osv/GHSA-4mvj-m6j5-pmf7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3930, GHSA-4mvj-m6j5-pmf7 | Dependencies (osv-scanner) |
| critical | osv/GHSA-5x8w-8jj5-q52h |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h | Dependencies (osv-scanner) |
| critical | osv/GHSA-6q48-6c7w-9gw2 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2 | Dependencies (osv-scanner) |
| critical | osv/GHSA-82r6-8w77-94w6 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4025, GHSA-82r6-8w77-94w6 | Dependencies (osv-scanner) |
| critical | osv/GHSA-8g5g-8vmr-9782 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 | Dependencies (osv-scanner) |
| critical | osv/GHSA-ffc3-869f-jxw9 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4145, GHSA-ffc3-869f-jxw9 | Dependencies (osv-scanner) |
| critical | osv/GHSA-fgcw-684q-jj6r |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r | Dependencies (osv-scanner) |
| critical | osv/GHSA-gm8q-m8mv-jj5m |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-558, GHSA-gm8q-m8mv-jj5m | Dependencies (osv-scanner) |
| critical | osv/GHSA-jhr6-gm9c-rqjv |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4164, GHSA-jhr6-gm9c-rqjv | Dependencies (osv-scanner) |
| critical | osv/GHSA-m4rf-3fr8-xwx3 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3749, GHSA-m4rf-3fr8-xwx3 | Dependencies (osv-scanner) |
| critical | osv/GHSA-p423-j2cm-9vmq |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-36, GHSA-p423-j2cm-9vmq | Dependencies (osv-scanner) |
| critical | osv/GHSA-w889-685w-c8fh |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh | Dependencies (osv-scanner) |
| critical | osv/GHSA-x99w-6fgc-pmfw |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3735, GHSA-x99w-6fgc-pmfw | Dependencies (osv-scanner) |
| critical | osv/GHSA-xvh5-g6gv-559v |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v | Dependencies (osv-scanner) |
| critical | osv/GHSA-pqg4-j6r4-53mv |
package-lock.json | [email protected] (npm) is affected by GHSA-pqg4-j6r4-53mv | Dependencies (osv-scanner) |
| high | opengrep/python.lang.maintainability.useless-inner-function |
backend/app/__init__.py:72 | function `health` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
backend/app/api/report.py:540 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
backend/app/services/graph_builder.py:671 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
backend/app/services/graph_builder.py:772 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
backend/app/services/simulation_ipc.py:176 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
backend/app/services/simulation_runner.py:529 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
backend/app/services/simulation_runner.py:656 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
backend/app/services/zep_graph_memory_updater.py:442 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
backend/app/services/zep_graph_memory_updater.py:620 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
backend/scripts/validate_zep_cloud_integration.py:297 | time.sleep() call; did you mean to leave this in? | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/docker-image.yml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-image.yml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-image.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-image.yml:36 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-image.yml:44 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-image.yml:53 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/dockerfile.security.missing-user |
Dockerfile:29 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
backend/app/services/simulation_runner.py:539 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | osv/GHSA-22hg-r758-rrw9 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9 | Dependencies (osv-scanner) |
| high | osv/GHSA-27h8-gf7j-v5hc |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc | Dependencies (osv-scanner) |
| high | osv/GHSA-27vj-qcqg-25rc |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4217, GHSA-27vj-qcqg-25rc | Dependencies (osv-scanner) |
| high | osv/GHSA-29pf-2h5f-8g72 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2289, GHSA-29pf-2h5f-8g72 | Dependencies (osv-scanner) |
| high | osv/GHSA-2wc2-fm75-p42x |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3071, GHSA-2wc2-fm75-p42x | Dependencies (osv-scanner) |
| high | osv/GHSA-38jv-5279-wg99 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1996, GHSA-38jv-5279-wg99 | Dependencies (osv-scanner) |
| high | osv/GHSA-394h-qwmc-48pf |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-394h-qwmc-48pf | Dependencies (osv-scanner) |
| high | osv/GHSA-3gq4-3j92-5w49 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3736, GHSA-3gq4-3j92-5w49 | Dependencies (osv-scanner) |
| high | osv/GHSA-3j72-p6qg-6xp7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7 | Dependencies (osv-scanner) |
| high | osv/GHSA-3jp2-3mrg-2vxc |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-3jp2-3mrg-2vxc | Dependencies (osv-scanner) |
| high | osv/GHSA-3x9g-8vmp-wqvf |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3387, GHSA-3x9g-8vmp-wqvf | Dependencies (osv-scanner) |
| high | osv/GHSA-42gh-23hr-vphw |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-42gh-23hr-vphw | Dependencies (osv-scanner) |
| high | osv/GHSA-4558-3h8r-v8xp |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp | Dependencies (osv-scanner) |
| high | osv/GHSA-45hq-cxwh-f6vc |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc | Dependencies (osv-scanner) |
| high | osv/GHSA-4j32-57v6-6g45 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2213, GHSA-4j32-57v6-6g45 | Dependencies (osv-scanner) |
| high | osv/GHSA-4vqv-7265-gm2w |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-4vqv-7265-gm2w | Dependencies (osv-scanner) |
| high | osv/GHSA-537c-gmf6-5ccf |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-537c-gmf6-5ccf | Dependencies (osv-scanner) |
| high | osv/GHSA-5849-834g-hvw5 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-5849-834g-hvw5 | Dependencies (osv-scanner) |
| high | osv/GHSA-58r4-6rv3-gfh8 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5gh2-94qg-qppq |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3867, GHSA-5gh2-94qg-qppq | Dependencies (osv-scanner) |
| high | osv/GHSA-5jq2-8x83-x246 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4153, GHSA-5jq2-8x83-x246 | Dependencies (osv-scanner) |
| high | osv/GHSA-5rvq-cxj2-64vf |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3036, GHSA-5rvq-cxj2-64vf | Dependencies (osv-scanner) |
| high | osv/GHSA-5vjq-rrrf-7h2q |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-5vjq-rrrf-7h2q | Dependencies (osv-scanner) |
| high | osv/GHSA-5x94-69rx-g8h2 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2 | Dependencies (osv-scanner) |
| high | osv/GHSA-5xf7-4p34-54qr |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3612, GHSA-5xf7-4p34-54qr | Dependencies (osv-scanner) |
| high | osv/GHSA-5xm2-6676-qcp9 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9 | Dependencies (osv-scanner) |
| high | osv/GHSA-62m5-6wh8-28x7 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-62m5-6wh8-28x7 | Dependencies (osv-scanner) |
| high | osv/GHSA-62p4-gmf7-7g93 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93 | Dependencies (osv-scanner) |
| high | osv/GHSA-63cw-57p8-fm3p |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2286, GHSA-63cw-57p8-fm3p | Dependencies (osv-scanner) |
| high | osv/GHSA-65qm-jvmh-6pqg |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg | Dependencies (osv-scanner) |
| high | osv/GHSA-6655-6qjp-jx7x |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-6655-6qjp-jx7x | Dependencies (osv-scanner) |
| high | osv/GHSA-69w3-r845-3855 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2288, GHSA-69w3-r845-3855 | Dependencies (osv-scanner) |
| high | osv/GHSA-6c7f-9265-g8fw |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-6c7f-9265-g8fw | Dependencies (osv-scanner) |
| high | osv/GHSA-6hwm-xvph-95vm |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3868, GHSA-6hwm-xvph-95vm | Dependencies (osv-scanner) |
| high | osv/GHSA-6r8x-57c9-28j4 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4 | Dependencies (osv-scanner) |
| high | osv/GHSA-6w3r-xr62-4xcp |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-6w3r-xr62-4xcp | Dependencies (osv-scanner) |
| high | osv/GHSA-6ww7-3frv-cqxh |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3733, GHSA-6ww7-3frv-cqxh | Dependencies (osv-scanner) |
| high | osv/GHSA-752w-5fwx-jx9f |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-120, GHSA-752w-5fwx-jx9f | Dependencies (osv-scanner) |
| high | osv/GHSA-78cv-mqj4-43f7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2287, GHSA-78cv-mqj4-43f7, GHSA-fqwm-6jpj-5wxc | Dependencies (osv-scanner) |
| high | osv/GHSA-7984-qgvg-3j9c |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-7984-qgvg-3j9c | Dependencies (osv-scanner) |
| high | osv/GHSA-7mwm-ghpf-9vrm |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm | Dependencies (osv-scanner) |
| high | osv/GHSA-82w8-qh3p-5jfq |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-249, GHSA-82w8-qh3p-5jfq | Dependencies (osv-scanner) |
| high | osv/GHSA-836r-79rf-4m37 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3072, GHSA-836r-79rf-4m37 | Dependencies (osv-scanner) |
| high | osv/GHSA-84m7-p3x7-pcfv |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-84m7-p3x7-pcfv | Dependencies (osv-scanner) |
| high | osv/GHSA-8988-9cw3-xx77 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4175, GHSA-8988-9cw3-xx77 | Dependencies (osv-scanner) |
| high | osv/GHSA-8fx7-8jr8-84rv |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-8fx7-8jr8-84rv | Dependencies (osv-scanner) |
| high | osv/GHSA-8mgp-746c-j5xp |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3740, GHSA-8mgp-746c-j5xp | Dependencies (osv-scanner) |
| high | osv/GHSA-8mp2-v27r-99xp |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2651, GHSA-8mp2-v27r-99xp | Dependencies (osv-scanner) |
| high | osv/GHSA-8rjx-v5ww-45pp |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-8rjx-v5ww-45pp | Dependencies (osv-scanner) |
| high | osv/GHSA-8v84-f9pq-wr9x |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x | Dependencies (osv-scanner) |
| high | osv/GHSA-94p9-xgh2-xp45 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4011, GHSA-94p9-xgh2-xp45 | Dependencies (osv-scanner) |
| high | osv/GHSA-97qj-x29f-37w7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3748, GHSA-97qj-x29f-37w7 | Dependencies (osv-scanner) |
| high | osv/GHSA-9hw9-ch79-4vh6 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6 | Dependencies (osv-scanner) |
| high | osv/GHSA-9v7f-9g4p-ffgj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4144, GHSA-9v7f-9g4p-ffgj | Dependencies (osv-scanner) |
| high | osv/GHSA-9v9v-9qvf-h2hj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj | Dependencies (osv-scanner) |
| high | osv/GHSA-c2m8-h5v5-343r |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-c2m8-h5v5-343r | Dependencies (osv-scanner) |
| high | osv/GHSA-c6hw-5grf-ff96 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96 | Dependencies (osv-scanner) |
| high | osv/GHSA-c8j7-8cv4-2xmq |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2210, GHSA-c8j7-8cv4-2xmq | Dependencies (osv-scanner) |
| high | osv/GHSA-c947-3pg5-gm8q |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-c947-3pg5-gm8q | Dependencies (osv-scanner) |
| high | osv/GHSA-c978-59m8-c77v |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-c978-59m8-c77v | Dependencies (osv-scanner) |
| high | osv/GHSA-cfh3-3jmp-rvhc |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc | Dependencies (osv-scanner) |
| high | osv/GHSA-cggf-277g-3q54 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-cggf-277g-3q54 | Dependencies (osv-scanner) |
| high | osv/GHSA-chx6-46f5-w4vp |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-chx6-46f5-w4vp | Dependencies (osv-scanner) |
| high | osv/GHSA-f2g6-542v-9j58 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58 | Dependencies (osv-scanner) |
| high | osv/GHSA-f794-5jv7-7672 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3741, GHSA-f794-5jv7-7672 | Dependencies (osv-scanner) |
| high | osv/GHSA-f833-7jw8-xwrv |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3789, GHSA-f833-7jw8-xwrv | Dependencies (osv-scanner) |
| high | osv/GHSA-ffq3-xpv3-j92q |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2216, GHSA-ffq3-xpv3-j92q | Dependencies (osv-scanner) |
| high | osv/GHSA-fp3h-c4fm-7vvf |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4154, GHSA-fp3h-c4fm-7vvf | Dependencies (osv-scanner) |
| high | osv/GHSA-g6cj-pr64-35w5 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3552, GHSA-g6cj-pr64-35w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-g7cr-3p24-7wf7 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7 | Dependencies (osv-scanner) |
| high | osv/GHSA-g842-9rc4-69pw |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw | Dependencies (osv-scanner) |
| high | osv/GHSA-g867-7843-wf8q |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3613, GHSA-g867-7843-wf8q | Dependencies (osv-scanner) |
| high | osv/GHSA-g9cg-prrw-2r8q |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4155, GHSA-g9cg-prrw-2r8q | Dependencies (osv-scanner) |
| high | osv/GHSA-gg2r-wvfm-q9rx |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx | Dependencies (osv-scanner) |
| high | osv/GHSA-gmh7-3g9r-mjh5 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-gmh7-3g9r-mjh5 | Dependencies (osv-scanner) |
| high | osv/GHSA-hvrp-rf83-w775 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3481, GHSA-hvrp-rf83-w775 | Dependencies (osv-scanner) |
| high | osv/GHSA-j456-xh4h-cpf2 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-j456-xh4h-cpf2 | Dependencies (osv-scanner) |
| high | osv/GHSA-j4m9-6w36-pw47 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47 | Dependencies (osv-scanner) |
| high | osv/GHSA-jg86-v3jv-hrpm |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm | Dependencies (osv-scanner) |
| high | osv/GHSA-jjj6-mw9f-p565 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565 | Dependencies (osv-scanner) |
| high | osv/GHSA-jpw9-pfvf-9f58 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3482, GHSA-jpw9-pfvf-9f58 | Dependencies (osv-scanner) |
| high | osv/GHSA-jr96-gvgh-j3r4 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-jr96-gvgh-j3r4 | Dependencies (osv-scanner) |
| high | osv/GHSA-jw7q-gvrg-4vj3 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4156, GHSA-jw7q-gvrg-4vj3 | Dependencies (osv-scanner) |
| high | osv/GHSA-jwv3-5hgf-82ww |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3553, GHSA-jwv3-5hgf-82ww | Dependencies (osv-scanner) |
| high | osv/GHSA-mf9v-mfxr-j63j |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-142, GHSA-mf9v-mfxr-j63j | Dependencies (osv-scanner) |
| high | osv/GHSA-mfr5-77xh-9j7h |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-mfr5-77xh-9j7h | Dependencies (osv-scanner) |
| high | osv/GHSA-mgf9-4vpg-hj56 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3389, GHSA-mgf9-4vpg-hj56 | Dependencies (osv-scanner) |
| high | osv/GHSA-mmhr-3c5m-f64f |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-mmhr-3c5m-f64f | Dependencies (osv-scanner) |
| high | osv/GHSA-mpf4-983q-p7j4 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3928, GHSA-mpf4-983q-p7j4 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrfp-p49p-3hf2 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2 | Dependencies (osv-scanner) |
| high | osv/GHSA-p4g4-x82p-q773 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4149, GHSA-p4g4-x82p-q773 | Dependencies (osv-scanner) |
| high | osv/GHSA-p4rw-rvv2-7xwr |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3737, GHSA-p4rw-rvv2-7xwr | Dependencies (osv-scanner) |
| high | osv/GHSA-p4wg-p73j-c528 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528 | Dependencies (osv-scanner) |
| high | osv/GHSA-p58f-9548-mpm2 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4013, GHSA-p58f-9548-mpm2 | Dependencies (osv-scanner) |
| high | osv/GHSA-pchr-8j38-3x4p |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p | Dependencies (osv-scanner) |
| high | osv/GHSA-phj9-mv4w-65pm |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm | Dependencies (osv-scanner) |
| high | osv/GHSA-php9-fj8v-98fj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4157, GHSA-php9-fj8v-98fj | Dependencies (osv-scanner) |
| high | osv/GHSA-pjvx-prjx-h659 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-pjvx-prjx-h659 | Dependencies (osv-scanner) |
| high | osv/GHSA-pp6c-gr5w-3c5g |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3039, GHSA-pp6c-gr5w-3c5g | Dependencies (osv-scanner) |
| high | osv/GHSA-pwv6-vv43-88gr |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr | Dependencies (osv-scanner) |
| high | osv/GHSA-pxh4-856f-4h89 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-pxh4-856f-4h89 | Dependencies (osv-scanner) |
| high | osv/GHSA-q45j-58j2-45rg |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg | Dependencies (osv-scanner) |
| high | osv/GHSA-qccp-gfcp-xxvc |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-141, GHSA-qccp-gfcp-xxvc | Dependencies (osv-scanner) |
| high | osv/GHSA-qcq2-496w-v96p |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2652, GHSA-qcq2-496w-v96p | Dependencies (osv-scanner) |
| high | osv/GHSA-qg35-44qx-7vrr |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-qg35-44qx-7vrr | Dependencies (osv-scanner) |
| high | osv/GHSA-qjxf-f2mg-c6mc |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-140, GHSA-qjxf-f2mg-c6mc | Dependencies (osv-scanner) |
| high | osv/GHSA-qv6h-rv94-w285 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4158, GHSA-qv6h-rv94-w285 | Dependencies (osv-scanner) |
| high | osv/GHSA-qx2g-xrx7-vfh8 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3870, GHSA-qx2g-xrx7-vfh8 | Dependencies (osv-scanner) |
| high | osv/GHSA-r6ph-v2qm-q3c2 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2141, GHSA-r6ph-v2qm-q3c2 | Dependencies (osv-scanner) |
| high | osv/GHSA-v247-6f48-mgcj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4159, GHSA-v247-6f48-mgcj | Dependencies (osv-scanner) |
| high | osv/GHSA-vfmq-68hx-4jfw |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-87, GHSA-vfmq-68hx-4jfw | Dependencies (osv-scanner) |
| high | osv/GHSA-vj7q-gjh5-988w |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3483, GHSA-vj7q-gjh5-988w | Dependencies (osv-scanner) |
| high | osv/GHSA-vjc4-5qp5-m44j |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j | Dependencies (osv-scanner) |
| high | osv/GHSA-vxj4-q4g9-crj7 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-vxj4-q4g9-crj7 | Dependencies (osv-scanner) |
| high | osv/GHSA-vxq7-64xx-v4gw |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4177, GHSA-vxq7-64xx-v4gw | Dependencies (osv-scanner) |
| high | osv/GHSA-w23x-9jrw-r45c |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4160, GHSA-w23x-9jrw-r45c | Dependencies (osv-scanner) |
| high | osv/GHSA-w3v8-gmh9-3wv7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3751, GHSA-w3v8-gmh9-3wv7 | Dependencies (osv-scanner) |
| high | osv/GHSA-whj4-6x5x-4v2j |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j | Dependencies (osv-scanner) |
| high | osv/GHSA-wp53-j4wj-2cfg |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1852, GHSA-wp53-j4wj-2cfg | Dependencies (osv-scanner) |
| high | osv/GHSA-wqp7-x3pw-xc5r |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2281, GHSA-wqp7-x3pw-xc5r | Dependencies (osv-scanner) |
| high | osv/GHSA-ww6m-cw3f-q94g |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3738, GHSA-ww6m-cw3f-q94g | Dependencies (osv-scanner) |
| high | osv/GHSA-x33g-cr3x-6449 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4183, GHSA-x33g-cr3x-6449 | Dependencies (osv-scanner) |
| high | osv/GHSA-x3rh-gjgm-fmqc |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-x3rh-gjgm-fmqc | Dependencies (osv-scanner) |
| high | osv/GHSA-x78j-v8h9-3j2q |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4014, GHSA-x78j-v8h9-3j2q | Dependencies (osv-scanner) |
| high | osv/GHSA-x9r9-c232-4q39 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4174, GHSA-x9r9-c232-4q39 | Dependencies (osv-scanner) |
| high | osv/GHSA-xcvg-w56q-r89m |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m | Dependencies (osv-scanner) |
| high | osv/GHSA-xgh8-jp6q-p5x8 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8 | Dependencies (osv-scanner) |
| high | osv/GHSA-xgmm-8j9v-c9wx |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-179, GHSA-xgmm-8j9v-c9wx | Dependencies (osv-scanner) |
| high | osv/GHSA-xj96-63gp-2gmr |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr | Dependencies (osv-scanner) |
| high | osv/GHSA-xm59-rqc7-hhvf |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1691, GHSA-xm59-rqc7-hhvf | Dependencies (osv-scanner) |
| high | osv/GHSA-xrqw-3rrv-vx5w |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3929, GHSA-xrqw-3rrv-vx5w | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-183 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2025-183 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-217 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2025-217 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2026-139 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-139 | Dependencies (osv-scanner) |
| high | osv/GHSA-2v37-7h3g-55p8 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 | Dependencies (osv-scanner) |
| high | osv/GHSA-3pq3-5fj3-cg6v |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3pq3-5fj3-cg6v | Dependencies (osv-scanner) |
| high | osv/GHSA-542g-h47m-68v8 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-542g-h47m-68v8 | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q | Dependencies (osv-scanner) |
| high | osv/GHSA-83rm-6c8r-g728 |
frontend/package-lock.json | @intlify/[email protected] (npm) is affected by GHSA-83rm-6c8r-g728 | Dependencies (osv-scanner) |
| high | osv/GHSA-83rm-6c8r-g728 |
frontend/package-lock.json | @intlify/[email protected] (npm) is affected by GHSA-83rm-6c8r-g728 | Dependencies (osv-scanner) |
| high | osv/GHSA-83rm-6c8r-g728 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-83rm-6c8r-g728 | Dependencies (osv-scanner) |
| high | osv/GHSA-8r9p-f939-6h3c |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-8r9p-f939-6h3c | Dependencies (osv-scanner) |
| high | osv/GHSA-c29m-xwm3-cm6r |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-c29m-xwm3-cm6r | Dependencies (osv-scanner) |
| high | osv/GHSA-g2v6-rqmx-r4w6 |
frontend/package-lock.json | @vue/[email protected] (npm) is affected by GHSA-g2v6-rqmx-r4w6 | Dependencies (osv-scanner) |
| high | osv/GHSA-m8m8-qj5v-23w3 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-m8m8-qj5v-23w3 | Dependencies (osv-scanner) |
| high | osv/GHSA-mghh-pgcx-3jjj |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mghh-pgcx-3jjj | Dependencies (osv-scanner) |
| high | osv/GHSA-mrwp-f3q8-3g9p |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mrwp-f3q8-3g9p | Dependencies (osv-scanner) |
| high | osv/GHSA-q3jh-wrc6-jgq8 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-q3jh-wrc6-jgq8 | Dependencies (osv-scanner) |
| high | osv/GHSA-r4gj-5m52-g5wh |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-r4gj-5m52-g5wh | Dependencies (osv-scanner) |
| high | osv/GHSA-x97p-jq2g-jp4f |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-x97p-jq2g-jp4f | Dependencies (osv-scanner) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/star_history.py:197 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/star_history.py:24 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/oasis_profile_generator.py:109 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/app/services/ontology_generator.py:391 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/app/services/ontology_generator.py:395 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/app/services/ontology_generator.py:405 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_config_generator.py:102 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_config_generator.py:106 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_config_generator.py:110 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_config_generator.py:174 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_config_generator.py:68 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_config_generator.py:98 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_ipc.py:46 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_ipc.py:73 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/simulation_manager.py:471 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/simulation_manager.py:473 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_manager.py:74 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_manager.py:75 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
backend/app/services/simulation_runner.py:146 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/simulation_runner.py:450 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/zep_entity_reader.py:218 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/zep_entity_reader.py:421 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
backend/app/services/zep_tools.py:1197 | Is "is_expired" a function or an attribute? If it is a function, you may have meant edge.is_expired() because edge.is_expired is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
backend/app/services/zep_tools.py:1197 | Is "is_invalid" a function or an attribute? If it is a function, you may have meant edge.is_invalid() because edge.is_invalid is always true. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/zep_tools.py:539 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/zep_tools.py:743 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/services/zep_tools.py:775 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/utils/retry.py:108 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/utils/retry.py:179 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/utils/retry.py:227 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
backend/app/utils/retry.py:55 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:100 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:106 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:116 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:122 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:128 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:52 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:58 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:64 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:70 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:76 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:82 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:88 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
backend/scripts/validate_zep_cloud_integration.py:94 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1000 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1002 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1004 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1007 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1013 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1019 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1022 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1024 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1026 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1028 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1030 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:1032 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:983 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:990 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:993 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/star_history.py:996 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | zizmor/artipacked |
.github/workflows/docker-image.yml:25 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/GHSA-68rp-wp8r-4726 |
backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2151, GHSA-68rp-wp8r-4726 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mf9w-mj56-hr94 |
backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2270, GHSA-mf9w-mj56-hr94 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mr82-8j83-vxmv |
backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1812, GHSA-mr82-8j83-vxmv | Dependencies (osv-scanner) |
| medium | osv/GHSA-23w6-3w8w-8484 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3910, GHSA-23w6-3w8w-8484 | Dependencies (osv-scanner) |
| medium | osv/GHSA-248m-82v9-q6g6 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3004, GHSA-248m-82v9-q6g6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-24rc-8hj2-v98c |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c | Dependencies (osv-scanner) |
| medium | osv/GHSA-254f-3936-288h |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-254f-3936-288h | Dependencies (osv-scanner) |
| medium | osv/GHSA-2gx3-rcp4-g85q |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4140, GHSA-2gx3-rcp4-g85q | Dependencies (osv-scanner) |
| medium | osv/GHSA-2hm2-hc3v-44h9 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2218, GHSA-2hm2-hc3v-44h9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-2q4j-m29v-hq73 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1827, GHSA-2q4j-m29v-hq73 | Dependencies (osv-scanner) |
| medium | osv/GHSA-32r8-54hf-c9p3 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1993, GHSA-32r8-54hf-c9p3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-39mj-jf6j-2qj3 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-39mj-jf6j-2qj3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3crg-w4f6-42mx |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3006, GHSA-3crg-w4f6-42mx | Dependencies (osv-scanner) |
| medium | osv/GHSA-3hhw-38pf-pxj6 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3726, GHSA-3hhw-38pf-pxj6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3hv7-mjh2-fv65 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-3hv7-mjh2-fv65 | Dependencies (osv-scanner) |
| medium | osv/GHSA-428g-f7cq-pgp5 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1605, GHSA-428g-f7cq-pgp5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-42vr-xj54-vc7v |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4141, GHSA-42vr-xj54-vc7v | Dependencies (osv-scanner) |
| medium | osv/GHSA-43mp-35q3-x3fq |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-43mp-35q3-x3fq | Dependencies (osv-scanner) |
| medium | osv/GHSA-462x-pgg6-55fp |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp | Dependencies (osv-scanner) |
| medium | osv/GHSA-4c99-qj7h-p3vg |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2229, GHSA-4c99-qj7h-p3vg | Dependencies (osv-scanner) |
| medium | osv/GHSA-4j63-6c4x-wfg4 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-4j63-6c4x-wfg4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4pxv-j86v-mhcw |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3007, GHSA-4pxv-j86v-mhcw | Dependencies (osv-scanner) |
| medium | osv/GHSA-4rm8-3hmm-39fg |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg | Dependencies (osv-scanner) |
| medium | osv/GHSA-4x4j-2g7c-83w6 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4xgf-cpjx-pc3j |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-4xgf-cpjx-pc3j | Dependencies (osv-scanner) |
| medium | osv/GHSA-52x6-gq3r-vpf4 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3009, GHSA-52x6-gq3r-vpf4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-558c-9hv2-4prj |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-558c-9hv2-4prj | Dependencies (osv-scanner) |
| medium | osv/GHSA-55h5-xmcq-c37v |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3610, GHSA-55h5-xmcq-c37v | Dependencies (osv-scanner) |
| medium | osv/GHSA-58cw-g322-p94v |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-168, GHSA-58cw-g322-p94v | Dependencies (osv-scanner) |
| medium | osv/GHSA-597g-3phw-6986 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2009, GHSA-597g-3phw-6986 | Dependencies (osv-scanner) |
| medium | osv/GHSA-5h93-6whr-6q8j |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-5h93-6whr-6q8j | Dependencies (osv-scanner) |
| medium | osv/GHSA-5hgr-hg42-57jg |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3010, GHSA-5hgr-hg42-57jg | Dependencies (osv-scanner) |
| medium | osv/GHSA-5p39-cfhj-2xmp |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4024, GHSA-5p39-cfhj-2xmp | Dependencies (osv-scanner) |
| medium | osv/GHSA-5qjq-93h5-hrgp |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3611, GHSA-5qjq-93h5-hrgp | Dependencies (osv-scanner) |
| medium | osv/GHSA-65pc-fj4g-8rjx |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-215, GHSA-65pc-fj4g-8rjx | Dependencies (osv-scanner) |
| medium | osv/GHSA-68rp-wp8r-4726 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2151, GHSA-68rp-wp8r-4726 | Dependencies (osv-scanner) |
| medium | osv/GHSA-69hj-f68j-2879 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-69hj-f68j-2879 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6vvc-x485-93v7 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-6vvc-x485-93v7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6w46-j5rx-g56g |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1845, GHSA-6w46-j5rx-g56g | Dependencies (osv-scanner) |
| medium | osv/GHSA-74r2-7ff9-mjj2 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-763m-79hh-57f2 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3911, GHSA-763m-79hh-57f2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-7g44-g9rc-x53w |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-7g44-g9rc-x53w | Dependencies (osv-scanner) |
| medium | osv/GHSA-7gw9-cf7v-778f |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3011, GHSA-7gw9-cf7v-778f | Dependencies (osv-scanner) |
| medium | osv/GHSA-7jqv-fw35-gmx9 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2230, GHSA-7jqv-fw35-gmx9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-7mh2-4gg2-979f |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-7mh2-4gg2-979f | Dependencies (osv-scanner) |
| medium | osv/GHSA-8423-8fgw-73vq |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-8423-8fgw-73vq | Dependencies (osv-scanner) |
| medium | osv/GHSA-86qp-5c8j-p5mr |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-161, GHSA-86qp-5c8j-p5mr | Dependencies (osv-scanner) |
| medium | osv/GHSA-87hc-h4r5-73f7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2044, GHSA-87hc-h4r5-73f7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-87mj-5ggw-8qc3 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3012, GHSA-87mj-5ggw-8qc3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8c25-4j27-2rv3 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2211, GHSA-8c25-4j27-2rv3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8g87-j6q8-g93x |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2206, GHSA-8g87-j6q8-g93x | Dependencies (osv-scanner) |
| medium | osv/GHSA-8mpj-m6qm-5qr8 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2215, GHSA-8mpj-m6qm-5qr8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8mpw-7fpc-4gqj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3752, GHSA-8mpw-7fpc-4gqj | Dependencies (osv-scanner) |
| medium | osv/GHSA-8mx5-7m5m-r77g |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-8mx5-7m5m-r77g | Dependencies (osv-scanner) |
| medium | osv/GHSA-9754-6rhw-gj3h |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-9754-6rhw-gj3h | Dependencies (osv-scanner) |
| medium | osv/GHSA-993g-76c3-p5m4 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-175, GHSA-993g-76c3-p5m4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-996q-pr4m-cvgq |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3013, GHSA-996q-pr4m-cvgq | Dependencies (osv-scanner) |
| medium | osv/GHSA-9h9j-4vrj-gf7g |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4012, GHSA-9h9j-4vrj-gf7g | Dependencies (osv-scanner) |
| medium | osv/GHSA-9m86-7pmv-2852 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3014, GHSA-9m86-7pmv-2852 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9mvc-8737-8j8h |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3015, GHSA-9mvc-8737-8j8h | Dependencies (osv-scanner) |
| medium | osv/GHSA-9mx8-4j7g-633p |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-9mx8-4j7g-633p | Dependencies (osv-scanner) |
| medium | osv/GHSA-cgf9-327m-v77c |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-cgf9-327m-v77c | Dependencies (osv-scanner) |
| medium | osv/GHSA-cj93-chg6-vgv8 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3016, GHSA-cj93-chg6-vgv8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-cw65-gx24-rc82 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-cw65-gx24-rc82 | Dependencies (osv-scanner) |
| medium | osv/GHSA-cw6x-m8jw-qmrh |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3739, GHSA-cw6x-m8jw-qmrh | Dependencies (osv-scanner) |
| medium | osv/GHSA-f2v5-7jq9-h8cg |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3017, GHSA-f2v5-7jq9-h8cg | Dependencies (osv-scanner) |
| medium | osv/GHSA-f54x-cmq8-qg57 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-f54x-cmq8-qg57 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc2g-4w5p-6whm |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-fc2g-4w5p-6whm | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc8x-2rww-xw9m |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3912, GHSA-fc8x-2rww-xw9m | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc9g-5qg7-mf45 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45 | Dependencies (osv-scanner) |
| medium | osv/GHSA-ff5c-cp5c-9wjf |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3869, GHSA-ff5c-cp5c-9wjf | Dependencies (osv-scanner) |
| medium | osv/GHSA-ffr9-mgrr-wcvr |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-ffr9-mgrr-wcvr | Dependencies (osv-scanner) |
| medium | osv/GHSA-fj7v-r99m-22gq |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq | Dependencies (osv-scanner) |
| medium | osv/GHSA-fp3f-mc75-235c |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3655, GHSA-fp3f-mc75-235c | Dependencies (osv-scanner) |
| medium | osv/GHSA-fwg2-594c-jp42 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3656, GHSA-fwg2-594c-jp42 | Dependencies (osv-scanner) |
| medium | osv/GHSA-g75f-g53v-794x |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-g75f-g53v-794x | Dependencies (osv-scanner) |
| medium | osv/GHSA-g97x-gvcm-x72h |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2214, GHSA-g97x-gvcm-x72h | Dependencies (osv-scanner) |
| medium | osv/GHSA-g9xf-7f8q-9mcj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3018, GHSA-g9xf-7f8q-9mcj | Dependencies (osv-scanner) |
| medium | osv/GHSA-gc5v-m9x4-r6x2 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gh4c-6fx4-qh6g |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4176, GHSA-gh4c-6fx4-qh6g | Dependencies (osv-scanner) |
| medium | osv/GHSA-gj48-438w-jh9v |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-gj48-438w-jh9v | Dependencies (osv-scanner) |
| medium | osv/GHSA-gjv8-xp57-g29c |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4170, GHSA-gjv8-xp57-g29c | Dependencies (osv-scanner) |
| medium | osv/GHSA-gpwc-27cw-rh9r |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-gpwc-27cw-rh9r | Dependencies (osv-scanner) |
| medium | osv/GHSA-h35f-9h28-mq5c |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3447, GHSA-h35f-9h28-mq5c | Dependencies (osv-scanner) |
| medium | osv/GHSA-h7ww-273w-6cm8 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-h7ww-273w-6cm8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-hhxq-47xx-j5xx |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-hhxq-47xx-j5xx | Dependencies (osv-scanner) |
| medium | osv/GHSA-hj66-6f7g-4r5v |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4113, GHSA-hj66-6f7g-4r5v | Dependencies (osv-scanner) |
| medium | osv/GHSA-hqmh-ppp3-xvm7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3019, GHSA-hqmh-ppp3-xvm7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-hxm8-2xgr-2p9m |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4147, GHSA-hxm8-2xgr-2p9m | Dependencies (osv-scanner) |
| medium | osv/GHSA-j543-4vmf-qm7v |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3020, GHSA-j543-4vmf-qm7v | Dependencies (osv-scanner) |
| medium | osv/GHSA-j934-xhv5-fg8f |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4171, GHSA-j934-xhv5-fg8f | Dependencies (osv-scanner) |
| medium | osv/GHSA-jj6c-8h6c-hppx |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3021, GHSA-jj6c-8h6c-hppx | Dependencies (osv-scanner) |
| medium | osv/GHSA-jm82-fx9c-mx94 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-jm82-fx9c-mx94 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jp53-mhqp-8xcg |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3913, GHSA-jp53-mhqp-8xcg | Dependencies (osv-scanner) |
| medium | osv/GHSA-jp82-jpqv-5vv3 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-248, GHSA-jp82-jpqv-5vv3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jq35-7prp-9v3f |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-176, GHSA-jq35-7prp-9v3f | Dependencies (osv-scanner) |
| medium | osv/GHSA-jwrc-g2q2-pq5p |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4148, GHSA-jwrc-g2q2-pq5p | Dependencies (osv-scanner) |
| medium | osv/GHSA-m2h6-j472-rp4c |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3554, GHSA-m2h6-j472-rp4c | Dependencies (osv-scanner) |
| medium | osv/GHSA-m2v9-299j-rv96 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3022, GHSA-m2v9-299j-rv96 | Dependencies (osv-scanner) |
| medium | osv/GHSA-m959-cc7f-wv43 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-35, GHSA-m959-cc7f-wv43 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mf9w-mj56-hr94 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2270, GHSA-mf9w-mj56-hr94 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mj87-hwqh-73pj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3038, GHSA-mj87-hwqh-73pj | Dependencies (osv-scanner) |
| medium | osv/GHSA-p8hx-v2p6-rp84 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84 | Dependencies (osv-scanner) |
| medium | osv/GHSA-pcg2-g6cj-q92c |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-pcg2-g6cj-q92c | Dependencies (osv-scanner) |
| medium | osv/GHSA-pw6j-qg29-8w7f |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-pw6j-qg29-8w7f | Dependencies (osv-scanner) |
| medium | osv/GHSA-qfhq-4f3w-5fph |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-qfhq-4f3w-5fph | Dependencies (osv-scanner) |
| medium | osv/GHSA-qfrw-5rxm-mhh2 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2217, GHSA-qfrw-5rxm-mhh2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-qfv9-64jg-mh7p |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-qfv9-64jg-mh7p | Dependencies (osv-scanner) |
| medium | osv/GHSA-qmgc-5h2g-mvrw |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-1374, GHSA-qmgc-5h2g-mvrw | Dependencies (osv-scanner) |
| medium | osv/GHSA-qpxp-75px-xjcp |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3023, GHSA-qpxp-75px-xjcp | Dependencies (osv-scanner) |
| medium | osv/GHSA-r4j5-9xpp-3985 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-r4j5-9xpp-3985 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r4rv-85jg-w4mf |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2212, GHSA-r4rv-85jg-w4mf | Dependencies (osv-scanner) |
| medium | osv/GHSA-r73j-pqj5-w3x7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rfgq-q3w2-pmv2 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rrmf-rvhw-rf47 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-rrmf-rvhw-rf47 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rwrf-2pqf-9j8j |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-rwrf-2pqf-9j8j | Dependencies (osv-scanner) |
| medium | osv/GHSA-v5mq-3xhg-98m9 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-v5mq-3xhg-98m9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-v87v-83h2-53w7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2207, GHSA-v87v-83h2-53w7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vp2x-qp44-57v7 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3871, GHSA-vp2x-qp44-57v7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vx6w-vv9f-6gvg |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg | Dependencies (osv-scanner) |
| medium | osv/GHSA-w4fh-qvv9-3v23 |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-w4fh-qvv9-3v23 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w6j9-cwv2-h6wq |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4152, GHSA-w6j9-cwv2-h6wq | Dependencies (osv-scanner) |
| medium | osv/GHSA-w7vc-732c-9m39 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-178, GHSA-w7vc-732c-9m39 | Dependencies (osv-scanner) |
| medium | osv/GHSA-wgvp-vg3v-2xq3 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3024, GHSA-wgvp-vg3v-2xq3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjqc-6w8f-h24c |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3025, GHSA-wjqc-6w8f-h24c | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjx4-4jcj-g98j |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j | Dependencies (osv-scanner) |
| medium | osv/GHSA-wqgw-9xfh-qf2g |
backend/uv.lock | [email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g | Dependencies (osv-scanner) |
| medium | osv/GHSA-x284-j5p8-9c5p |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3026, GHSA-x284-j5p8-9c5p | Dependencies (osv-scanner) |
| medium | osv/GHSA-x746-7m8f-x49c |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2280, GHSA-x746-7m8f-x49c | Dependencies (osv-scanner) |
| medium | osv/GHSA-x7hp-r3qg-r3cj |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-3027, GHSA-x7hp-r3qg-r3cj | Dependencies (osv-scanner) |
| medium | osv/GHSA-xpv3-w29h-x7cv |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4114, GHSA-xpv3-w29h-x7cv | Dependencies (osv-scanner) |
| medium | osv/PYSEC-2026-2208 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2208 | Dependencies (osv-scanner) |
| medium | osv/PYSEC-2026-2209 |
backend/uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-2209 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.vue.security.audit.xss.templates.avoid-v-html |
frontend/src/components/Step4Report.vue:51 | Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.vue.security.audit.xss.templates.avoid-v-html |
frontend/src/components/Step5Interaction.vue:273 | Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.vue.security.audit.xss.templates.avoid-v-html |
frontend/src/components/Step5Interaction.vue:403 | Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.vue.security.audit.xss.templates.avoid-v-html |
frontend/src/components/Step5Interaction.vue:51 | Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. [confidence low] | Static analysis (opengrep) |
| low | opengrep/python.lang.correctness.useless-eqeq |
scripts/star_history.py:1056 | This expression is always True: `OWNER_AVATAR_MEDIA_TYPE == OWNER_AVATAR_MEDIA_TYPE` or `OWNER_AVATAR_MEDIA_TYPE != OWNER_AVATAR_MEDIA_TYPE`. If testing for floating point NaN, use `math.isnan(OWNER_AVATAR_MEDIA_TYPE)`, or... | Lint |
| low | opengrep/python.lang.security.use-defusedcsv |
backend/app/services/oasis_profile_generator.py:1136 | Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
txt2graph/lib/vis-9.1.2/vis-network.min.js:26 | Possible generic-api-key secret in history (commit 9657061b26); removed from the current tree but still retrievable | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 69 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 7 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 300 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 9 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 7657031ac011 | prov-5+qual-2+sec-2 | 10% | 51 | 53 |
Full text report
- Repository: https://github.com/666ghj/MiroFish
- Commit:
7657031ac01184afe2cb220f5ee3545573b5e843 - Generated: 2026-11-14T15:07:27+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 10 | explicit | 95% | 100% |
| Code quality | 51 | weak | 90% | 100% |
| Security | 53 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 10% of first-party code added; an estimated 10% including velocity signals.
- Explicitly attributed share (lower bound): 10.3%
- Unattributed share in AI-consistent velocity bursts: 47.5%
- Estimated AI-generated share: 10.3%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 7 | 6,672 |
| Cursor agent | 1 | 0 |
Current source lines last changed by AI-attributed commits: 3,538 of 46,873.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 5.37 | 1.154 | 4.65x |
| Security | 0.0 | 0.185 | 0.0x |
- Stylometry index: 0.53 per 1,000 lines (narrated steps 10, placeholders 0, assistant phrasing 0, emoji 30). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-11 | 4,533 | 0% |
| 2025-12 | 45,009 | 0% |
| 2026-01 | 1,348 | 0% |
| 2026-02 | 1,248 | 0% |
| 2026-03 | 169 | 0% |
| 2026-04 | 1,749 | 0% |
| 2026-05 | 23 | 0% |
| 2026-07 | 10,308 | 63% |
| 2026-08 | 142 | 100% |
Evidence
- OpenAI Codex: PR branch 'codex/star-history-manual-merge' (0f67b29c6c3c)
- OpenAI Codex: PR branch 'codex/star-history-pr-mode' (a97ba4ffc9ad)
- OpenAI Codex: on merged branch (60757b3c82) (f0d487f31047)
- OpenAI Codex: on merged branch (d64175943e) (407c391f35c8)
- OpenAI Codex: on merged branch (d64175943e) (c81d62897543)
- OpenAI Codex: on merged branch (d64175943e) (54bd7a3d4ec5)
- OpenAI Codex: on merged branch (d64175943e) (e4aa38dff249)
- Cursor agent: author email [email protected] (84dd2cbcca28)
- 4,752 lines of first-party code in ~2.6h (1,856 lines/hour, 1 commit session) (e4aa38dff249)
- 1,564 lines of first-party code in ~1.1h (1,474 lines/hour, 1 commit session) (fc95cc6595bd)
- 5,801 lines of first-party code in ~4.0h (1,450 lines/hour, 1 commit session) (5f159f6d88e8)
- 4,635 lines of first-party code in ~4.1h (1,121 lines/hour, 11 commit session) (9db7781ee3de)
- 1,094 lines of first-party code in ~1.1h (1,019 lines/hour, 1 commit session) (54bd7a3d4ec5)
- 1,554 lines of first-party code in ~1.8h (863 lines/hour, 3 commit session) (74aab4476601)
- 2,309 lines of first-party code in ~2.8h (835 lines/hour, 3 commit session) (851b12dfd95c)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.10, CI runs tests; 29% of function code in complex or long functions; 15% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 42 |
| Duplication | 41 |
| Code smells (Opengrep) | 62 |
| Tests and CI | 63 |
| Documentation | 65 |
| Type safety | 0 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 1,028; mean complexity 4.3, 90th percentile 10; 45 complex and 25 long functions
- Duplicated lines: 15.0% of 34,976 compared
- Tests: 4,810 test lines for 46,873 source lines (ratio 0.10); CI test commands: unittest; 7% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- run in backend/scripts/validate_zep_cloud_integration.py: complexity 65, 329 lines
- _validate_svg in scripts/star_history.py: complexity 50, 217 lines
- _validate_and_process in backend/app/services/ontology_generator.py: complexity 40, 149 lines
- start_simulation in backend/app/api/simulation.py: complexity 37, 211 lines
- _build_graph_impl in backend/app/api/graph.py: complexity 35, 158 lines
Security
Security posture is weak: 332 known vulnerabilities in 49 dependencies; 4 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 96 |
| Vulnerable dependencies (OSV) | 0 |
| CI workflows (zizmor) | 30 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 332 in 49 packages (critical 16, high 151, medium 142, low 21)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-82r6-8w77-94w6: [email protected] (PyPI) is affected by PYSEC-2026-4025, GHSA-82r6-8w77-94w6 |
backend/uv.lock |
| critical | osv/GHSA-6q48-6c7w-9gw2: [email protected] (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2 |
backend/uv.lock |
| critical | osv/GHSA-p423-j2cm-9vmq: [email protected] (PyPI) is affected by PYSEC-2026-36, GHSA-p423-j2cm-9vmq |
backend/uv.lock |
| critical | osv/GHSA-x99w-6fgc-pmfw: [email protected] (PyPI) is affected by PYSEC-2026-3735, GHSA-x99w-6fgc-pmfw |
backend/uv.lock |
| critical | osv/GHSA-m4rf-3fr8-xwx3: [email protected] (PyPI) is affected by PYSEC-2026-3749, GHSA-m4rf-3fr8-xwx3 |
backend/uv.lock |
| critical | osv/GHSA-5x8w-8jj5-q52h: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
backend/uv.lock |
| critical | osv/GHSA-8g5g-8vmr-9782: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
backend/uv.lock |
| critical | osv/GHSA-xvh5-g6gv-559v: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
backend/uv.lock |
| critical | osv/GHSA-332p-7hrc-92wf: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf |
backend/uv.lock |
| critical | osv/GHSA-w889-685w-c8fh: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh |
backend/uv.lock |
| critical | osv/GHSA-ffc3-869f-jxw9: [email protected] (PyPI) is affected by PYSEC-2026-4145, GHSA-ffc3-869f-jxw9 |
backend/uv.lock |
| critical | osv/GHSA-jhr6-gm9c-rqjv: [email protected] (PyPI) is affected by PYSEC-2026-4164, GHSA-jhr6-gm9c-rqjv |
backend/uv.lock |
| critical | osv/GHSA-fgcw-684q-jj6r: [email protected] (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r |
backend/uv.lock |
| critical | osv/GHSA-4mvj-m6j5-pmf7: [email protected] (PyPI) is affected by PYSEC-2026-3930, GHSA-4mvj-m6j5-pmf7 |
backend/uv.lock |
| critical | osv/GHSA-gm8q-m8mv-jj5m: [email protected] (PyPI) is affected by PYSEC-2026-558, GHSA-gm8q-m8mv-jj5m |
backend/uv.lock |
| critical | osv/GHSA-pqg4-j6r4-53mv: [email protected] (npm) is affected by GHSA-pqg4-j6r4-53mv |
package-lock.json |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:29 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
backend/app/services/simulation_runner.py:539 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
scripts/star_history.py:24 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/star_history.py:197 |
| high | osv/GHSA-r6ph-v2qm-q3c2: [email protected] (PyPI) is affected by PYSEC-2026-2141, GHSA-r6ph-v2qm-q3c2 |
backend/uv.lock |
| high | osv/GHSA-g6cj-pr64-35w5: [email protected] (PyPI) is affected by PYSEC-2026-3552, GHSA-g6cj-pr64-35w5 |
backend/uv.lock |
| high | osv/GHSA-jwv3-5hgf-82ww: [email protected] (PyPI) is affected by PYSEC-2026-3553, GHSA-jwv3-5hgf-82ww |
backend/uv.lock |
| high | osv/GHSA-537c-gmf6-5ccf: [email protected] (PyPI) is affected by GHSA-537c-gmf6-5ccf |
backend/uv.lock |
| high | osv/GHSA-27vj-qcqg-25rc: [email protected] (PyPI) is affected by PYSEC-2026-4217, GHSA-27vj-qcqg-25rc |
backend/uv.lock |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 46,873; test lines: 4,810
| Language | Lines |
|---|---|
| Python | 30,707 |
| Vue | 20,461 |
| JavaScript | 515 |