Leaderboard github.com
Ebony-Vinyl/dsh-our-free-model
在 dsh 里装上这个插件即可，无需登录、注册或填 API Key，就能使用包括 DeepSeek V4.1 Flash、Kimi K3 在内的前沿模型——完全免费，不限量。 All you do is install this plugin in dsh: no login, no sign-up, no API key — the frontier models are just there, DeepSeek V4.1 Flash and Kimi K3 among them. Completely free, with no usage cap.
AI provenance
3%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
54/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
49/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
3% explicit
Explicit AI attribution on 3% of first-party code added; an estimated 3% including velocity signals.
How the score is built
- Explicitly attributed share3%
- Unattributed share in AI-pace bursts49%
- Estimated AI-generated share3%
- AI tool configuration files0
- Work sessions at AI pace13
- Releases at AI pace5
- Coding-style index (1.0+ means possible)0.06
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| OpenAI Codex | 41 | 7,367 | 2026-09-30 | 2026-10-24 |
| Claude Code | 1 | 181 | 2026-10-30 | 2026-10-30 |
Lines added per month all AI-attributed share
- 2026-0914,371 · 1% AI
- 2026-10192,263 · 4% AI
- 2026-1127,093 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 759 lines trace to AI-attributed commits, 99,089 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 2.63 | 2.00 | 1.32× |
| Security | 0.00 | 0.78 | 0.00× |
Evidence by analyzer
Explicit AI attributionok27 items
- OpenAI Codex: 41 attributed commits, 7,367 lines added
- Claude Code: 1 attributed commits, 181 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- OpenAI Codex: on merged branch (f3ecb7abcf)
- OpenAI Codex: on merged branch (3bbc85e123)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (08c6cd68e4)
- OpenAI Codex: on merged branch (25ab765d6b)
- OpenAI Codex: on merged branch (25ab765d6b)
- OpenAI Codex: on merged branch (1f92730b38)
- OpenAI Codex: on merged branch (1f92730b38)
- OpenAI Codex: on merged branch (1f92730b38)
- OpenAI Codex: on merged branch (1f92730b38)
- OpenAI Codex: on merged branch (1f92730b38)
- OpenAI Codex: on merged branch (1f92730b38)
- OpenAI Codex: on merged branch (1277977c18)
- OpenAI Codex: on merged branch (207f58c6be)
- OpenAI Codex: on merged branch (207f58c6be)
- OpenAI Codex: on merged branch (207f58c6be)
- OpenAI Codex: on merged branch (207f58c6be)
- attributed_commit_share
- 6.2%
- attributed_commits
- 42
- attributed_loc
- 7,548
- attributed_loc_share
- 3.2%
- commits
- 677
- effective_loc
- 233,727
- tools_detected
- 2
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok13 items
- 70,136 lines of first-party code in ~1.9h (36,957 lines/hour, 11 commit session)
- 7,324 lines of first-party code in ~4.1h (1,799 lines/hour, 3 commit session)
- 8,116 lines of first-party code in ~5.2h (1,561 lines/hour, 4 commit session)
- 1,531 lines of first-party code in ~1.1h (1,444 lines/hour, 1 commit session)
- 5,511 lines of first-party code in ~4.0h (1,369 lines/hour, 3 commit session)
- 5,223 lines of first-party code in ~5.2h (999 lines/hour, 3 commit session)
- 3,474 lines of first-party code in ~4.1h (844 lines/hour, 2 commit session)
- 3,335 lines of first-party code in ~4.0h (834 lines/hour, 1 commit session)
- 3,016 lines of first-party code in ~3.7h (821 lines/hour, 1 commit session)
- 3,172 lines of first-party code in ~4.0h (793 lines/hour, 1 commit session)
- 3,380 lines of first-party code in ~4.6h (739 lines/hour, 7 commit session)
- 2,427 lines of first-party code in ~4.0h (607 lines/hour, 1 commit session)
- 2,242 lines of first-party code in ~4.0h (560 lines/hour, 1 commit session)
- excluded_import_loc
- 55,069
- flagged_loc
- 118,887
- flagged_loc_share
- 66.5%
- flagged_units
- 13
- max_loc_per_hour
- 36,956.91
- measured_loc
- 178,658
- median_loc_per_hour
- 131.25
- pr_timed_units
- 12
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 196
Release velocityok5 items
- v1.4.6 → v2.0.0: 6,986 lines in 1.74 days (4,018.3 lines/day)
- v2.0.0 → v2.1.0: 81,587 lines in 4.06 days (20,105.2 lines/day)
- v2.3.0 → v2.4.0: 5,187 lines in 1.48 days (3,498.5 lines/day)
- v2.5.1 → v2.5.2: 8,200 lines in 0.19 days (44,296.6 lines/day)
- v2.5.8-macos-unofficial → v2.5.9: 5,611 lines in 0.82 days (6,802.6 lines/day)
- flagged_releases
- 5
- max_loc_per_day
- 44,296.60
- releases
- 45
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 10
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 5
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0.06
- lines_scanned
- 90,081
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.11
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 759
- blame_failures
- 0
- files_blamed
- 353
- other_lines
- 99,089
- quality:ai_findings
- 2
- quality:ai_per_kloc
- 2.63
- quality:other_findings
- 198
- quality:other_per_kloc
- 2.00
- quality:ratio
- 1.32
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 77
- security:other_per_kloc
- 0.78
- security:ratio
- 0
Code quality
54 weak
Code quality is weak: test-to-source ratio 0.00, CI runs tests; 27% of function code in complex or long functions; 7% duplicated lines. Weakest area: testing.
How the score is built
- Complexity45
- Duplication68
- Lint and smells60
- Tests and CI35
- Documentation65
- Type safety97
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- handler in index.js: complexity 288, 466 lines
- route in packages/standalone/management.mjs: complexity 249, 375 lines
- (anonymous) in packages/standalone/web/app.js: complexity 161, 1 lines
- wv in packages/standalone/web/app.js: complexity 157, 1 lines
- Ke in packages/standalone/web/app.js: complexity 145, 1 lines
- Tf in packages/standalone/web/app.js: complexity 143, 1 lines
- runSingle in src/adapter.js: complexity 143, 262 lines
- Yv in packages/standalone/web/app.js: complexity 127, 1 lines
- fromGeminiRequest in src/gemini.js: complexity 93, 124 lines
- ot in packages/standalone/web/app.js: complexity 91, 1 lines
- complex_functions
- 377
- function_nloc
- 72,991
- functions
- 13,817
- long_functions
- 37
- many_param_functions
- 8
- mean_ccn
- 2.96
- p90_ccn
- 6
- risky_nloc_share
- 26.8%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: client.js:1801 and packages/standalone/web/channels-CqFHCMz8.js:2
- 6+ duplicated lines: client.js:2398 and client.js:2580
- 6+ duplicated lines: packages/standalone/frontend/agents.tsx:38 and packages/standalone/frontend/library.tsx:138
- 6+ duplicated lines: packages/standalone/frontend/library.tsx:62 and packages/standalone/frontend/library.tsx:102
- 6+ duplicated lines: packages/standalone/frontend/library.tsx:137 and packages/standalone/frontend/routing.tsx:195
- 6+ duplicated lines: scripts/aggregate-test.mjs:434 and scripts/aggregate-test.mjs:475
- 6+ duplicated lines: scripts/aggregate-wiring-test.mjs:34 and scripts/live-feature-verify.mjs:47
- 6+ duplicated lines: scripts/aggregate-wiring-test.mjs:54 and scripts/ui-preview.mjs:60
- 6+ duplicated lines: scripts/auto-checkin-tick-test.mjs:26 and scripts/opencode-parity-test.mjs:37
- 6+ duplicated lines: scripts/channel-credits-ui-test.mjs:17 and scripts/channel-login-test.mjs:23
- compared_lines
- 81,100
- duplicated_lines
- 5,292
- duplicated_share
- 6.5%
- files
- 353
Lintok
- category:best-practice
- 14
- category:correctness
- 521
- category:maintainability
- 1
- findings
- 536
- scanned_lines
- 99,848
- weighted_findings
- 205
Tests and CIok6 items
- CI config: .github/workflows/build-macos.yml
.github/workflows/build-macos.yml - CI config: .github/workflows/build-windows.yml
.github/workflows/build-windows.yml - CI config: .github/workflows/prepare-release.yml
.github/workflows/prepare-release.yml - CI config: .github/workflows/release-sign.yml
.github/workflows/release-sign.yml - CI config: .github/workflows/test.yml
.github/workflows/test.yml - CI runs tests (npm run test)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- no
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 5
- cochange_commits
- 168
- cochange_share
- 0.0%
- source_lines
- 99,848
- test_lines
- 0
- test_ratio
- 0
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 582
Type safetyok1 item
- TypeScript strict type checking: packages/standalone/tsconfig.json
packages/standalone/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 3
- escapes_per_kloc
- 0.85
Security
49 poor
Security posture is poor: 2 possible secret(s) in the tree, 2 only in history; 8 known vulnerabilities in 8 dependencies; 5 high-severity SAST findings; 4 high-severity workflow issues. Weakest area: posture.
How the score is built
- Secrets20
- Static analysis (SAST)94
- Vulnerable dependencies62
- CI workflows53
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 30
- declared
- 30
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 2
- secrets_history
- 2
- secrets_low_confidence
- 14
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 68
- findings_high
- 5
- findings_low
- 9
- findings_medium
- 54
- parse_errors
- 3
- scanned_lines
- 99,848
- weighted_findings
- 19.26
Dependencies (osv-scanner)ok
- penalty
- 29
- vulnerabilities
- 8
- vulnerable_packages
- 8
- vulns_critical
- 0
- vulns_high
- 1
- vulns_low
- 0
- vulns_medium
- 1
- vulns_unknown
- 6
CI workflows (zizmor)ok
- findings
- 10
- findings_high
- 4
- findings_low
- 0
- findings_medium
- 6
- penalty
- 38.40
- workflows
- 5
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 7.0%
- unpinned_manifests
- 0
Release downloadsok6 items
- release v2.8.3 ships dsh-our-free-model-2.8.3.tgz (13050 downloads)
- release v2.8.3 ships Our.Free.Model_2.8.3_aarch64.dmg (766 downloads)
- release v2.8.3 ships Our.Free.Model_2.8.3_x64-setup.exe (7137 downloads)
- release v2.8.2-macos-unofficial ships Our.Free.Model_2.8.2_aarch64.dmg (65 downloads)
- release v2.8.2 ships dsh-our-free-model-2.8.2.tgz (771 downloads)
- 73982 stars in 51 days (1452/day)
- binary_assets
- 14
- signals
- 2
- suspicious
- 0
Findings
13 high160 medium131 low
304 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/typescript.lang.correctness.useless-ternary |
scripts/aggregate-wiring-test.mjs:199 | It looks like no matter how ctx.__captured is evaluated, this expression returns undefined. This is probably a copy-paste error. | Lint |
| high | zizmor/cache-poisoning |
.github/workflows/build-macos.yml:19 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-macos.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/build-windows.yml:31 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-windows.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
package-lock.json | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | gitleaks/curl-auth-header |
packages/standalone/frontend/connection.tsx:15 | Possible curl-auth-header secret in the current tree | Secrets (gitleaks) |
| high | gitleaks/curl-auth-header |
packages/standalone/web/app.js:10 | Possible curl-auth-header secret in the current tree | Secrets (gitleaks) |
| high | opengrep/javascript.browser.security.insecure-document-method |
packages/standalone/web/app.js:10 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
packages/standalone/web/app.js:10 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
packages/standalone/web/app.js:10 | User controlled data in a `e.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
packages/standalone/web/app.js:10 | User controlled data in a `e.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/plugins-e2e.py:28 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
client.js:26 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
client.js:27 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
client.js:4574 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
client.js:7359 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/standalone/client-terminal.mjs:12 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/standalone/client-terminal.mjs:13 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/app.tsx:85 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:16 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:23 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:28 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:35 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:40 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:46 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:50 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
packages/standalone/frontend/components/ui.tsx:58 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/standalone/library.mjs:266 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/standalone/library.mjs:267 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/standalone/login-terminal.mjs:7 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/standalone/login-terminal.mjs:8 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
packages/standalone/open-external.mjs:12 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
packages/standalone/workbench.mjs:151 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/aggregate-test.mjs:508 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/build-magpie-engine.mjs:155 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/build-magpie-engine.mjs:157 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/channel-pack-test.mjs:814 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/channel-pack-test.mjs:815 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/channel-pack-test.mjs:816 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/channel-pack-test.mjs:817 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/client-terminal-test.mjs:20 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/desktop-test.mjs:99 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/desktop-update-test.mjs:115 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/egress-test.mjs:408 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/egress-test.mjs:410 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/egress-test.mjs:411 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/engine-transport-test.mjs:47 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/fingerprint-test.mjs:289 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/fingerprint-test.mjs:41 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/host-selftest.mjs:301 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/magpie-native-ui-test.mjs:149 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
scripts/magpie-native-ui-test.mjs:269 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/magpie-plugin-test.mjs:313 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/magpie-plugin-test.mjs:316 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/mint-eac-seal.mjs:58 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/offline-test.mjs:132 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/open-external-test.mjs:27 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/opencode-parity-test.mjs:153 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/opencode-parity-test.mjs:159 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
scripts/plugins-e2e.py:131 | `return` only makes sense inside a function | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/plugins-test.mjs:432 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/probes/stream-terminal-frames.mjs:57 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/probes/stream-terminal-frames.mjs:58 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/probes/tool-calling.mjs:42 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/probes/tool-calling.mjs:42 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/probes/tool-calling.mjs:43 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/probes/tool-calling.mjs:44 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/recovery-test.mjs:848 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/recovery-test.mjs:849 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/recovery-test.mjs:854 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/standalone-desktop-regression-test.mjs:17 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/standalone-login-terminal-test.mjs:11 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/standalone-login-terminal-test.mjs:28 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/standalone-login-terminal-test.mjs:85 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/standalone-package-test.mjs:269 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/standalone-ui-preview.mjs:123 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/standalone-ui-preview.mjs:131 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/subscription-ui-test.mjs:46 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/tui-test.mjs:142 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/ui-preview.mjs:295 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:564 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:564 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:564 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:564 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:565 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:565 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:565 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/updater-test.mjs:599 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/vault-test.mjs:201 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/vault-test.mjs:205 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/workbench-management-test.mjs:38 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/workbench-management-test.mjs:60 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/workbench-native-desktop-test.mjs:337 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
scripts/workbench-native-desktop-test.mjs:356 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
scripts/workbench-native-desktop-test.mjs:45 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
src/magpie-engine.js:1111 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
src/magpie-engine.js:929 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
src/open-external.js:30 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
worker/auth-github.mjs:132 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
worker/auth-github.mjs:132 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
worker/auth-github.mjs:132 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
worker/auth-github.mjs:132 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
worker/auth-github.mjs:132 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | zizmor/artipacked |
.github/workflows/build-macos.yml:18 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/build-windows.yml:30 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test.yml:21 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test.yml:38 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test.yml:51 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test.yml:61 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
client.js:4081 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
index.js:1917 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | osv/GHSA-wrw7-89jp-8q8g |
packages/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0429, GHSA-wrw7-89jp-8q8g | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0370 |
packages/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0370 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0370 |
packages/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0370 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0371 |
packages/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0371 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0372 |
packages/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0372 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0386 |
packages/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0386 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0486 |
packages/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0486 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/standalone/channels/runtime.mjs:37 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | gitleaks/curl-auth-header |
packages/standalone/frontend/legacy.js:242 | Possible curl-auth-header secret in history (commit 0da7e86502); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration |
packages/standalone/frontend/plugin-page.tsx:57 | The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
packages/standalone/library.mjs:266 | RegExp() called with a `format` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
packages/standalone/library.mjs:267 | RegExp() called with a `format` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
packages/standalone/management.mjs:207 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
packages/standalone/management.mjs:209 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/standalone/management.mjs:518 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/standalone/management.mjs:527 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
packages/standalone/management.mjs:537 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.browser.security.insufficient-postmessage-origin-validation |
packages/standalone/web/app.js:19 | No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS). [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration |
packages/standalone/web/app.js:19 | The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.jquery-insecure-selector |
packages/standalone/web/app.js:19 | User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/channel-network-test.mjs:18 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | gitleaks/private-key |
scripts/codearts-direct-fetch-test.mjs:16 | Possible private-key secret in history (commit d8656844af); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | opengrep/javascript.lang.security.audit.unknown-value-with-script-tag |
scripts/engine-appearance-test.mjs:25 | Cannot determine what 'plugin' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'plugin' is not externally controlled, or sanitize this data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/engine-appearance-test.mjs:42 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
scripts/lib/fake-kernel.mjs:205 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/local-optimize-test.mjs:123 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/local-optimize-test.mjs:393 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unknown-value-with-script-tag |
scripts/magpie-sandbox-test.mjs:23 | Cannot determine what 'plugin' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'plugin' is not externally controlled, or sanitize this data. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/magpie-sandbox-test.mjs:45 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/probes/stream-terminal-frames.mjs:55 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
scripts/rtk-shape-test.mjs:27 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/sanitize-test.mjs:141 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
scripts/subscription-ui-test.mjs:123 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/test-all.mjs:24 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/updater-test.mjs:324 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
scripts/updater-test.mjs:347 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.hardcoded-hmac-key |
scripts/vault-test.mjs:422 | Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
src/adapter.js:222 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
src/eac.js:67 | RegExp() called with a `raw` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
src/eac.js:75 | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
src/http.js:500 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
src/local-optimize.js:287 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.browser.security.insufficient-postmessage-origin-validation |
src/magpie-engine.js:451 | No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS). [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
src/magpie-engine.js:603 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
src/magpie-engine.js:607 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
src/magpie-engine.js:609 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
src/magpie-engine.js:611 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
src/magpie-policy.js:187 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.insecure-object-assign |
src/stream.js:601 | Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
src/token-saver.js:803 | RegExp() called with a `re` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
src/token-saver/rtk/autodetect.js:169 | RegExp() called with a `re` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
src/updater.js:899 | RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
src/upstream.js:422 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:141 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:629 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:636 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:643 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:646 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:659 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:663 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
worker/auth-github.mjs:670 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:1800 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:1800 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:4081 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:4081 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:5425 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:5425 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:5425 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:7179 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
client.js:7179 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2567 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2567 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2577 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2577 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2588 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2588 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2595 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
index.js:2595 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/client-terminal.mjs:273 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/client-terminal.mjs:273 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/client-terminal.mjs:279 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/client-terminal.mjs:298 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/frontend/app.tsx:36 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/frontend/app.tsx:36 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/frontend/connection.tsx:18 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/frontend/connection.tsx:18 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/frontend/connection.tsx:18 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:10 | `f` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:10 | `O` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:10 | `h` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/app.js:13 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/app.js:13 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/app.js:13 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/app.js:15 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/app.js:15 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/app.js:19 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/app.js:19 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:2 | `f` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:2 | `e` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:2 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.eqeq-is-bad |
packages/standalone/web/app.js:9 | Detected a useless comparison operation `wl == wl` or `wl != wl`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex. | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `l` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `An` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `l` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `Xo` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `a` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `r` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `s` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `a` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `a` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `a` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `qe` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `a` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `e` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `r` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
packages/standalone/web/app.js:9 | `a` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/channels-CqFHCMz8.js:1149 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/models-ChmCQDPX.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
packages/standalone/web/models-ChmCQDPX.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/build-magpie-engine.mjs:77 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/build-magpie-engine.mjs:77 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/build-manifest.mjs:214 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/build-manifest.mjs:214 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/build-sponsor.mjs:9 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/build-sponsor.mjs:9 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
scripts/chan-relay-test.mjs:99 | `response` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-network-test.mjs:185 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-pack-test.mjs:25 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-pack-test.mjs:417 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-pack-test.mjs:417 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-pack-test.mjs:813 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-pack-test.mjs:813 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-pack-test.mjs:817 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/channel-pack-test.mjs:817 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/client-terminal-test.mjs:315 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/client-terminal-test.mjs:315 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/client-terminal-test.mjs:367 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/client-terminal-test.mjs:367 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/desktop-test.mjs:19 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/desktop-test.mjs:19 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/eac-auth-test.mjs:68 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/eac-auth-test.mjs:68 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/eac-auth-test.mjs:68 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/eac-auth-test.mjs:68 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
scripts/eac-auth-test.mjs:68 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | gitleaks/generic-api-key |
client.js:53 | Possible generic-api-key secret in history (commit ea7f42538e); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.unsafe-usage |
packages/desktop/src-tauri/src/external.rs:16 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
packages/desktop/src-tauri/src/service.rs:209 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
packages/desktop/src-tauri/src/update.rs:150 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
packages/desktop/src-tauri/src/update.rs:212 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
packages/standalone/channels/business.mjs:41054 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
scripts/egress-test.mjs:551 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
scripts/extensions-test.mjs:332 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
scripts/subscription-ui-test.mjs:33 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
scripts/vault-test.mjs:364 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
scripts/workbench-test.mjs:204 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
src/sponsor.js:20 | Possible generic-api-key secret in history (commit ea7f42538e); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
src/subscriptions.js:34 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
vendor/channel-pack/pack.js:41065 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
vendor/channel-pack/src/gemini-oauth.ts:33 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
vendor/channel-pack/src/loomy-product.ts:119 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
vendor/jet-hub/pack.js:42551 | Possible generic-api-key secret in history (commit fba1eb2594); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
vendor/jet-hub/src/gemini-oauth.ts:38 | Possible generic-api-key secret in history (commit fba1eb2594); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
vendor/jet-hub/src/loomy-product.ts:125 | Possible generic-api-key secret in history (commit fba1eb2594); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | opengrep/javascript.audit.detect-replaceall-sanitization |
worker/auth-github.mjs:132 | Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '')`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known... | Static analysis (opengrep) |
| low | opengrep/javascript.audit.detect-replaceall-sanitization |
worker/auth-github.mjs:132 | Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '') .replaceAll('&', '&')`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's... | Static analysis (opengrep) |
| low | opengrep/javascript.audit.detect-replaceall-sanitization |
worker/auth-github.mjs:132 | Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '') .replaceAll('&', '&') .replaceAll('<', '<')`. Manually sanitizing input through a manually built list can be circumvented in... | Static analysis (opengrep) |
| low | opengrep/javascript.audit.detect-replaceall-sanitization |
worker/auth-github.mjs:132 | Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '') .replaceAll('&', '&') .replaceAll('<', '<') .replaceAll('>', '>')`. Manually sanitizing input through a manually built... | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 10 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 8 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 68 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 18 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | edfdaf2cb64b | prov-5+qual-2+sec-2 | 3% | 54 | 49 |
Full text report
- Repository: https://github.com/Ebony-Vinyl/dsh-our-free-model
- Commit:
edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15 - Generated: 2026-11-14T15:26:57+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 3 | explicit | 95% | 100% |
| Code quality | 54 | weak | 90% | 100% |
| Security | 49 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 3% of first-party code added; an estimated 3% including velocity signals.
- Explicitly attributed share (lower bound): 3.2%
- Unattributed share in AI-consistent velocity bursts: 48.5%
- Estimated AI-generated share: 3.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 41 | 7,367 |
| Claude Code | 1 | 181 |
Current source lines last changed by AI-attributed commits: 759 of 99,848.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 2.635 | 1.998 | 1.32x |
| Security | 0.0 | 0.777 | 0.0x |
- Stylometry index: 0.06 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 10). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-09 | 14,371 | 1% |
| 2026-10 | 192,263 | 4% |
| 2026-11 | 27,093 | 0% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (28a7ce5ca929)
- OpenAI Codex: on merged branch (f3ecb7abcf) (0a685e08f275)
- OpenAI Codex: on merged branch (3bbc85e123) (ed87b87ed604)
- OpenAI Codex: on merged branch (08c6cd68e4) (81785dff5485)
- OpenAI Codex: on merged branch (08c6cd68e4) (e39631d39474)
- OpenAI Codex: on merged branch (08c6cd68e4) (405aba9d2d5d)
- OpenAI Codex: on merged branch (08c6cd68e4) (f0e905320a42)
- OpenAI Codex: on merged branch (08c6cd68e4) (985301c3e060)
- OpenAI Codex: on merged branch (08c6cd68e4) (dbe292f12174)
- OpenAI Codex: on merged branch (08c6cd68e4) (86914d46257c)
- OpenAI Codex: on merged branch (08c6cd68e4) (ce5789caceeb)
- OpenAI Codex: on merged branch (08c6cd68e4) (f09733038c50)
- OpenAI Codex: on merged branch (25ab765d6b) (5866c24e29ea)
- OpenAI Codex: on merged branch (25ab765d6b) (9ce93072de50)
- OpenAI Codex: on merged branch (1f92730b38) (af7e37ec2a44)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.00, CI runs tests; 27% of function code in complex or long functions; 7% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 45 |
| Duplication | 68 |
| Code smells (Opengrep) | 60 |
| Tests and CI | 35 |
| Documentation | 65 |
| Type safety | 97 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 13,817; mean complexity 3.0, 90th percentile 6; 377 complex and 37 long functions
- Duplicated lines: 6.5% of 81,100 compared
- Tests: 0 test lines for 99,848 source lines (ratio 0.00); CI test commands: npm run test; 0% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- handler in index.js: complexity 288, 466 lines
- route in packages/standalone/management.mjs: complexity 249, 375 lines
- (anonymous) in packages/standalone/web/app.js: complexity 161, 1 lines
- wv in packages/standalone/web/app.js: complexity 157, 1 lines
- Ke in packages/standalone/web/app.js: complexity 145, 1 lines
Security
Security posture is poor: 2 possible secret(s) in the tree, 2 only in history; 8 known vulnerabilities in 8 dependencies; 5 high-severity SAST findings; 4 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 20 |
| Static analysis (Opengrep) | 94 |
| Vulnerable dependencies (OSV) | 62 |
| CI workflows (zizmor) | 53 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 8 in 8 packages (critical 0, high 1, medium 1, low 0)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | gitleaks/curl-auth-header: Possible curl-auth-header secret in the current tree |
packages/standalone/frontend/connection.tsx:15 |
| high | gitleaks/curl-auth-header: Possible curl-auth-header secret in the current tree |
packages/standalone/web/app.js:10 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
packages/standalone/web/app.js:10 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a e.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
packages/standalone/web/app.js:10 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
packages/standalone/web/app.js:10 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a e.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
packages/standalone/web/app.js:10 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/plugins-e2e.py:28 |
| high | osv/GHSA-mrhx-c7xc-m3w5: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 |
package-lock.json |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build-macos.yml:22 |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/build-macos.yml:19 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build-windows.yml:34 |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/build-windows.yml:31 |
| medium | gitleaks/private-key: Possible private-key secret in history (commit d8656844af); removed from the current tree but still retrievable |
scripts/codearts-direct-fetch-test.mjs:16 |
| medium | gitleaks/curl-auth-header: Possible curl-auth-header secret in history (commit 0da7e86502); removed from the current tree but still retrievable |
packages/standalone/frontend/legacy.js:242 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
client.js:4081 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
index.js:1917 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
packages/standalone/channels/runtime.mjs:37 |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration: The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] |
packages/standalone/frontend/plugin-page.tsx:57 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a format function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low] |
packages/standalone/library.mjs:266 |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a format function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low] |
packages/standalone/library.mjs:267 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
packages/standalone/management.mjs:207 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
packages/standalone/management.mjs:209 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
packages/standalone/management.mjs:518 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
packages/standalone/management.mjs:527 |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
packages/standalone/management.mjs:537 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v2.8.3 ships dsh-our-free-model-2.8.3.tgz (13050 downloads)
- binary-release-asset: release v2.8.3 ships Our.Free.Model_2.8.3_aarch64.dmg (766 downloads)
- binary-release-asset: release v2.8.3 ships Our.Free.Model_2.8.3_x64-setup.exe (7137 downloads)
- binary-release-asset: release v2.8.2-macos-unofficial ships Our.Free.Model_2.8.2_aarch64.dmg (65 downloads)
- binary-release-asset: release v2.8.2 ships dsh-our-free-model-2.8.2.tgz (771 downloads)
- star-burst: 73982 stars in 51 days (1452/day)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 99,848; test lines: 0
| Language | Lines |
|---|---|
| JavaScript | 95,451 |
| TypeScript | 3,340 |
| Rust | 877 |
| Python | 180 |