Leaderboard github.com

ItsNotCam/june

View repository ↗
TypeScript
★ 0
commit a4217b8ea8f5
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

30%

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

72/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

47/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

30% explicit

Explicit AI attribution on 30% of first-party code added; an estimated 30% including velocity signals.

How the score is built

Explicitly attributed share30%
Unattributed share in AI-pace bursts50%
Estimated AI-generated share30%
AI tool configuration files45
Work sessions at AI pace7
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.33

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	18	15,991	2026-04-21	2026-06-17

Lines added per month all AI-attributed share

2026-0430,925 · 41% AI
2026-0623,060 · 15% AI

Findings in AI-attributed lines vs the rest

From git blame: 9,709 lines trace to AI-attributed commits, 22,306 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	0.31	2.24	0.14×
Security	4.84	11.34	0.43×

Evidence by analyzer

Explicit AI attributionok19 items

attributed_commit_share: 11.5%
attributed_commits: 18
attributed_loc: 15,991
attributed_loc_share: 29.6%
commits: 156
effective_loc: 53,985
tools_detected: 1

AI tool configurationok45 items

5 more in the report JSON.

artifacts: 45
earliest_adoption: 2026-04-17
tools_configured: 1
workflow_agents: 0

Commit velocityok7 items

excluded_import_loc: 7,873
flagged_loc: 33,320
flagged_loc_share: 72.3%
flagged_units: 7
max_loc_per_hour: 4,238.64
measured_loc: 46,112
median_loc_per_hour: 213.58
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 36

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 21
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 8
files:narrated_steps: 0
files:placeholder: 0
index: 0.33
lines_scanned: 32,015
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.66
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 9,709
blame_failures: 0
files_blamed: 243
other_lines: 22,306
quality:ai_findings: 3
quality:ai_per_kloc: 0.31
quality:other_findings: 50
quality:other_per_kloc: 2.24
quality:ratio: 0.14
security:ai_findings: 47
security:ai_per_kloc: 4.84
security:other_findings: 253
security:other_per_kloc: 11.34
security:ratio: 0.43

Code quality

72 adequate

Code quality is adequate: test-to-source ratio 0.34, CI runs tests; 16% of function code in complex or long functions; 4% duplicated lines. Weakest area: docs.

How the score is built

Complexity63
Duplication81
Lint and smells71
Tests and CI82
Documentation40
Type safety100
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 15
function_nloc: 18,093
functions: 1,509
long_functions: 11
many_param_functions: 1
mean_ccn: 2.68
p90_ccn: 6
risky_nloc_share: 15.5%

Duplication (jscpd)ok10 items

compared_lines: 23,526
duplicated_lines: 825
duplicated_share: 3.5%
files: 243

Lintok

category:best-practice: 39
category:correctness: 14
findings: 53
scanned_lines: 31,868
weighted_findings: 43.25

Tests and CIok2 items

CI config: .github/workflows/bench-ci.yml .github/workflows/bench-ci.yml
CI runs tests (bun test)

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 1
cochange_commits: 81
cochange_share: 46.9%
source_lines: 32,015
test_lines: 11,015
test_ratio: 0.34

Documentationok1 item

README.md README.md

check:changelog: no
check:contributing: no
check:license: no
check:readme: yes
readme_lines: 40

Type safetyok1 item

TypeScript strict type checking: packages/next/tsconfig.json packages/next/tsconfig.json

check:low_escape_density: yes
check:strict_config: no
escapes: 12
escapes_per_kloc: 0.39

Security

47 poor

Security posture is poor: 165 known vulnerabilities in 30 dependencies; 19 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)35
Vulnerable dependencies3
CI workflows63
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 36
declared: 36
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 341
findings_high: 19
findings_low: 0
findings_medium: 322
parse_errors: 5
scanned_lines: 31,868
weighted_findings: 95.10

Dependencies (osv-scanner)ok

penalty: 207
vulnerabilities: 165
vulnerable_packages: 30
vulns_critical: 6
vulns_high: 67
vulns_low: 12
vulns_medium: 80
vulns_unknown: 0

CI workflows (zizmor)ok

findings: 4
findings_high: 2
findings_low: 0
findings_medium: 2
penalty: 27.60
workflows: 1

Security postureok4 items

packages/mcp/bench/package.json has no lockfile alongside it (unpinned dependencies) packages/mcp/bench/package.json
packages/mcp/server/package.json has no lockfile alongside it (unpinned dependencies) packages/mcp/server/package.json
packages/next/package.json has no lockfile alongside it (unpinned dependencies) packages/next/package.json
packages/shared/package.json has no lockfile alongside it (unpinned dependencies) packages/shared/package.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.0%
unpinned_manifests: 4

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

6 critical88 high403 medium25 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-2464-fhr4-w9xw`	bun.lock	[email protected] (npm) is affected by GHSA-2464-fhr4-w9xw; also in yarn.lock	Dependencies (osv-scanner)
critical	`osv/GHSA-2xp9-vwfh-vxw4`	bun.lock	[email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4; also in yarn.lock	Dependencies (osv-scanner)
critical	`osv/GHSA-673q-mjm6-r5xr`	bun.lock	[email protected] (npm) is affected by GHSA-673q-mjm6-r5xr; also in yarn.lock	Dependencies (osv-scanner)
critical	`osv/GHSA-jqcg-44mw-7w3h`	bun.lock	[email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h; also in yarn.lock	Dependencies (osv-scanner)
critical	`osv/GHSA-p293-qw3h-jr36`	bun.lock	[email protected] (npm) is affected by GHSA-p293-qw3h-jr36; also in yarn.lock	Dependencies (osv-scanner)
critical	`osv/GHSA-vcvr-r3jv-pc5j`	bun.lock	[email protected] (npm) is affected by GHSA-vcvr-r3jv-pc5j; also in yarn.lock	Dependencies (osv-scanner)
high	`zizmor/unpinned-uses`	.github/workflows/bench-ci.yml:32	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/bench-ci.yml:35	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`osv/GHSA-22jm-h49p-29qw`	bun.lock	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-22jm-h49p-29qw; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-267c-6grr-h53f`	bun.lock	[email protected] (npm) is affected by GHSA-267c-6grr-h53f; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-26hh-7cqf-hhc6`	bun.lock	[email protected] (npm) is affected by GHSA-26hh-7cqf-hhc6; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-27r3-jxmh-p828`	bun.lock	[email protected] (npm) is affected by GHSA-27r3-jxmh-p828; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-2883-xcg3-v3hh`	bun.lock	[email protected] (npm) is affected by GHSA-2883-xcg3-v3hh; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-28wg-ghj8-5hjv`	bun.lock	[email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-2m5v-pch6-74hx`	bun.lock	[email protected] (npm) is affected by GHSA-2m5v-pch6-74hx	Dependencies (osv-scanner)
high	`osv/GHSA-2v37-7h3g-55p8`	bun.lock	[email protected] (npm) is affected by GHSA-2v37-7h3g-55p8; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-36qx-fr4f-26g5`	bun.lock	[email protected] (npm) is affected by GHSA-36qx-fr4f-26g5; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-3jxr-9vmj-r5cp`	bun.lock	[email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-3jxr-9vmj-r5cp`	bun.lock	[email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-46jr-4wx8-v453`	bun.lock	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-492v-c6pp-mqqv`	bun.lock	[email protected] (npm) is affected by GHSA-492v-c6pp-mqqv; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-4c8g-83qw-93j6`	bun.lock	[email protected] (npm) is affected by GHSA-4c8g-83qw-93j6; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-52cp-r559-cp3m`	bun.lock	[email protected] (npm) is affected by GHSA-52cp-r559-cp3m; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-5p4m-2wfm-xmqj`	bun.lock	[email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	bun.lock	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-6g55-p6wh-862q`	bun.lock	[email protected] (npm) is affected by GHSA-6g55-p6wh-862q; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-6g55-p6wh-862q`	bun.lock	[email protected] (npm) is affected by GHSA-6g55-p6wh-862q; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-6gpp-xcg3-4w24`	bun.lock	[email protected] (npm) is affected by GHSA-6gpp-xcg3-4w24; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	bun.lock	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	bun.lock	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-6qxp-vccf-f47h`	bun.lock	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-6qxp-vccf-f47h; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-73wf-gq98-2v4g`	bun.lock	[email protected] (npm) is affected by GHSA-73wf-gq98-2v4g; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-7p8r-x3mc-p8w7`	bun.lock	[email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-7q85-xj36-vmfc`	bun.lock	[email protected] (npm) is affected by GHSA-7q85-xj36-vmfc	Dependencies (osv-scanner)
high	`osv/GHSA-8238-w5pm-2374`	bun.lock	[email protected] (npm) is affected by GHSA-8238-w5pm-2374	Dependencies (osv-scanner)
high	`osv/GHSA-88fw-hqm2-52qc`	bun.lock	[email protected] (npm) is affected by GHSA-88fw-hqm2-52qc; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-89xv-2m56-2m9x`	bun.lock	[email protected] (npm) is affected by GHSA-89xv-2m56-2m9x; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-8h8q-6873-q5fj`	bun.lock	[email protected] (npm) is affected by GHSA-8h8q-6873-q5fj; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-c4j6-fc7j-m34r`	bun.lock	[email protected] (npm) is affected by GHSA-c4j6-fc7j-m34r; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-c83g-rgw3-j3cx`	bun.lock	[email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-cjq9-62q9-8jv4`	bun.lock	[email protected] (npm) is affected by GHSA-cjq9-62q9-8jv4; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-f65p-4m7j-42xc`	bun.lock	[email protected] (npm) is affected by GHSA-f65p-4m7j-42xc; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-f88m-g3jw-g9cj`	bun.lock	[email protected] (npm) is affected by GHSA-f88m-g3jw-g9cj; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-f897-62hf-6gxq`	bun.lock	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-hmw2-7cc7-3qxx`	bun.lock	[email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx	Dependencies (osv-scanner)
high	`osv/GHSA-j5f4-cc29-5x44`	bun.lock	[email protected] (npm) is affected by GHSA-j5f4-cc29-5x44	Dependencies (osv-scanner)
high	`osv/GHSA-jqff-g426-hqxp`	bun.lock	[email protected] (npm) is affected by GHSA-jqff-g426-hqxp; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-m99w-x7hq-7vfj`	bun.lock	[email protected] (npm) is affected by GHSA-m99w-x7hq-7vfj; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-mg66-mrh9-m8jx`	bun.lock	[email protected] (npm) is affected by GHSA-mg66-mrh9-m8jx; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-mh99-v99m-4gvg`	bun.lock	[email protected] (npm) is affected by GHSA-mh99-v99m-4gvg; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-mh99-v99m-4gvg`	bun.lock	[email protected] (npm) is affected by GHSA-mh99-v99m-4gvg; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	bun.lock	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	bun.lock	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-mwp4-54f8-5fhr`	bun.lock	[email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-p3m5-59mp-jv5r`	bun.lock	[email protected] (npm) is affected by GHSA-p3m5-59mp-jv5r; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-p9j2-gv94-2wf4`	bun.lock	[email protected] (npm) is affected by GHSA-p9j2-gv94-2wf4; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-q3j6-qgpj-74h6`	bun.lock	[email protected] (npm) is affected by GHSA-q3j6-qgpj-74h6; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	bun.lock	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	bun.lock	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-qrxm-fqhp-jwvm`	bun.lock	[email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm	Dependencies (osv-scanner)
high	`osv/GHSA-qw65-cvwx-89v3`	bun.lock	[email protected] (npm) is affected by GHSA-qw65-cvwx-89v3; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-r28c-9q8g-f849`	bun.lock	[email protected] (npm) is affected by GHSA-r28c-9q8g-f849; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-r28c-9q8g-f849`	bun.lock	[email protected] (npm) is affected by GHSA-r28c-9q8g-f849; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-rcw4-f5rp-g42v`	bun.lock	[email protected] (npm) is affected by GHSA-rcw4-f5rp-g42v	Dependencies (osv-scanner)
high	`osv/GHSA-rfgv-xxqx-mfg5`	bun.lock	[email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5	Dependencies (osv-scanner)
high	`osv/GHSA-rgj7-g3m4-5g8c`	bun.lock	[email protected] (npm) is affected by GHSA-rgj7-g3m4-5g8c; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-rgw5-rvv9-x895`	bun.lock	[email protected] (npm) is affected by GHSA-rgw5-rvv9-x895; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-rgw5-rvv9-x895`	bun.lock	[email protected] (npm) is affected by GHSA-rgw5-rvv9-x895; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-v2hh-gcrm-f6hx`	bun.lock	[email protected] (npm) is affected by GHSA-v2hh-gcrm-f6hx; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-v39h-62p7-jpjc`	bun.lock	[email protected] (npm) is affected by GHSA-v39h-62p7-jpjc; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-vxpw-j846-p89q`	bun.lock	[email protected] (npm) is affected by GHSA-vxpw-j846-p89q	Dependencies (osv-scanner)
high	`osv/GHSA-wq5f-xc86-pv6w`	bun.lock	[email protected] (npm) is affected by GHSA-wq5f-xc86-pv6w; also in yarn.lock	Dependencies (osv-scanner)
high	`osv/GHSA-xcpc-8h2w-3j85`	bun.lock	[email protected] (npm) is affected by GHSA-xcpc-8h2w-3j85	Dependencies (osv-scanner)
high	`osv/GHSA-xjj6-f33q-929c`	bun.lock	[email protected] (npm) is affected by GHSA-xjj6-f33q-929c	Dependencies (osv-scanner)
high	`osv/GHSA-xwg4-73v4-xw9w`	bun.lock	[email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w; also in yarn.lock	Dependencies (osv-scanner)
high	`opengrep/javascript.lang.security.detect-child-process`	packages/mcp/bench/cli/health.ts:112	Detected calls to child_process from a function argument `juneBin`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly...	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:146	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:146	User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:157	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:157	User controlled data in a `chip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:289	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:289	User controlled data in a `meta.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:332	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:332	User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:352	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:352	User controlled data in a `tr.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:403	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:403	User controlled data in a `$("detail-body").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:406	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:406	User controlled data in a `$("detail-body").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:568	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:568	User controlled data in a `view.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	packages/mcp/bench/src/dashboard/public/app.js:653	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	packages/mcp/bench/src/dashboard/public/app.js:653	User controlled data in a `wrap.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	packages/mcp/bench/scripts/assemble-verdicts.py:11	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	packages/mcp/bench/scripts/assemble-verdicts.py:12	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	packages/mcp/bench/scripts/assemble-verdicts.py:35	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	packages/mcp/bench/src/providers/ollama.ts:121	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/button.tsx:54	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/card.tsx:19	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/card.tsx:32	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/card.tsx:45	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/card.tsx:55	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/card.tsx:68	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/card.tsx:78	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/card.tsx:91	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/chart.tsx:72	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/input.tsx:15	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/label.tsx:15	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:17	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:20	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:23	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:25	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:26	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:27	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:28	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:29	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:31	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:33	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:35	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:39	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:43	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/markdown.tsx:46	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:106	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:123	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:147	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:16	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:163	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:182	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:26	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:47	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/select.tsx:87	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/shadcn/switch.tsx:22	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	packages/next/components/theme/ThemeProvider.tsx:8	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`zizmor/excessive-permissions`	.github/workflows/bench-ci.yml:28	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/bench-ci.yml:32	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`osv/GHSA-2gcr-mfcq-wcc3`	bun.lock	[email protected] (npm) is affected by GHSA-2gcr-mfcq-wcc3; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-39w2-rjm5-chcv`	bun.lock	[email protected] (npm) is affected by GHSA-39w2-rjm5-chcv; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-3hrh-pfw6-9m5x`	bun.lock	[email protected] (npm) is affected by GHSA-3hrh-pfw6-9m5x; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-3wwx-pv8p-q78v`	bun.lock	[email protected] (npm) is affected by GHSA-3wwx-pv8p-q78v	Dependencies (osv-scanner)
medium	`osv/GHSA-4633-3j49-mh5q`	bun.lock	[email protected] (npm) is affected by GHSA-4633-3j49-mh5q; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-46wx-v44x-9hh2`	bun.lock	[email protected] (npm) is affected by GHSA-46wx-v44x-9hh2; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-4c39-4ccg-62r3`	bun.lock	[email protected] (npm) is affected by GHSA-4c39-4ccg-62r3; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-4h7h-rv7c-7m2v`	bun.lock	[email protected] (npm) is affected by GHSA-4h7h-rv7c-7m2v; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-4jqv-mc3x-m676`	bun.lock	[email protected] (npm) is affected by GHSA-4jqv-mc3x-m676; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-4m76-xfj5-7975`	bun.lock	[email protected] (npm) is affected by GHSA-4m76-xfj5-7975; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-4mjr-xmp4-gh2g`	bun.lock	[email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-4qv8-2p9j-2685`	bun.lock	[email protected] (npm) is affected by GHSA-4qv8-2p9j-2685	Dependencies (osv-scanner)
medium	`osv/GHSA-54fx-42gc-7vw4`	bun.lock	[email protected] (npm) is affected by GHSA-54fx-42gc-7vw4; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-5r4p-p66f-jhc7`	bun.lock	[email protected] (npm) is affected by GHSA-5r4p-p66f-jhc7; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-68g3-v927-f742`	bun.lock	[email protected] (npm) is affected by GHSA-68g3-v927-f742; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-69xw-7hcm-h432`	bun.lock	[email protected] (npm) is affected by GHSA-69xw-7hcm-h432; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-6pq8-jhm2-2vcw`	bun.lock	[email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-6prh-2h8m-c8cw`	bun.lock	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-6prh-2h8m-c8cw; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-8j4g-w8fx-2239`	bun.lock	[email protected] (npm) is affected by GHSA-8j4g-w8fx-2239; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-8xcm-r25x-g524`	bun.lock	[email protected] (npm) is affected by GHSA-8xcm-r25x-g524	Dependencies (osv-scanner)
medium	`osv/GHSA-955p-x3mx-jcvp`	bun.lock	[email protected] (npm) is affected by GHSA-955p-x3mx-jcvp; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-9fm3-97px-rjf6`	bun.lock	[email protected] (npm) is affected by GHSA-9fm3-97px-rjf6	Dependencies (osv-scanner)
medium	`osv/GHSA-9vqf-7f2p-gf9v`	bun.lock	[email protected] (npm) is affected by GHSA-9vqf-7f2p-gf9v; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-c6fg-446q-cg94`	bun.lock	[email protected] (npm) is affected by GHSA-c6fg-446q-cg94	Dependencies (osv-scanner)
medium	`osv/GHSA-crvj-82cr-hjcx`	bun.lock	[email protected] (npm) is affected by GHSA-crvj-82cr-hjcx; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-f23p-vx2j-j53r`	bun.lock	[email protected] (npm) is affected by GHSA-f23p-vx2j-j53r; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-f577-qrjj-4474`	bun.lock	[email protected] (npm) is affected by GHSA-f577-qrjj-4474; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-f87g-xv8r-7p7x`	bun.lock	[email protected] (npm) is affected by GHSA-f87g-xv8r-7p7x; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-ffhc-5mcf-pf4q`	bun.lock	[email protected] (npm) is affected by GHSA-ffhc-5mcf-pf4q; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-frvp-7c67-39w9`	bun.lock	@hono/[email protected] (npm) is affected by GHSA-frvp-7c67-39w9; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-fxqj-rqcc-2cmp`	bun.lock	[email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-fxqj-rqcc-2cmp`	bun.lock	[email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	bun.lock	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-g6gw-c38x-mqfc`	bun.lock	[email protected] (npm) is affected by GHSA-g6gw-c38x-mqfc; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-gcqx-w48m-w2h4`	bun.lock	[email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-gqvv-2mrq-wpjv`	bun.lock	[email protected] (npm) is affected by GHSA-gqvv-2mrq-wpjv; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-gx5p-jg67-6x7h`	bun.lock	[email protected] (npm) is affected by GHSA-gx5p-jg67-6x7h; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-h3mg-xc3c-68pw`	bun.lock	[email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-h64f-5h5j-jqjh`	bun.lock	[email protected] (npm) is affected by GHSA-h64f-5h5j-jqjh; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-h67p-54hq-rp68`	bun.lock	[email protected] (npm) is affected by GHSA-h67p-54hq-rp68; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-h7mg-cq63-vhpq`	bun.lock	[email protected] (npm) is affected by GHSA-h7mg-cq63-vhpq; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-hrr3-gc8f-f4qj`	bun.lock	[email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-hvrm-45r6-mjfj`	bun.lock	[email protected] (npm) is affected by GHSA-hvrm-45r6-mjfj; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-hxh3-vqpv-xpqv`	bun.lock	[email protected] (npm) is affected by GHSA-hxh3-vqpv-xpqv; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-j3f2-48v5-ccww`	bun.lock	[email protected] (npm) is affected by GHSA-j3f2-48v5-ccww	Dependencies (osv-scanner)
medium	`osv/GHSA-j6c9-x7qj-28xf`	bun.lock	[email protected] (npm) is affected by GHSA-j6c9-x7qj-28xf; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-j6r3-76f7-8jcv`	bun.lock	[email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-jpvv-r467-5p4w`	bun.lock	@hono/[email protected] (npm) is affected by GHSA-jpvv-r467-5p4w; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-jxxr-4gwj-5jf2`	bun.lock	[email protected] (npm) is affected by GHSA-jxxr-4gwj-5jf2; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-m8rv-5g2x-5cg5`	bun.lock	[email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5	Dependencies (osv-scanner)
medium	`osv/GHSA-mcj8-r9mp-w47p`	bun.lock	[email protected] (npm) is affected by GHSA-mcj8-r9mp-w47p; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-p498-v437-472g`	bun.lock	@humanfs/[email protected] (npm) is affected by GHSA-p498-v437-472g; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-p634-w6r4-rjp2`	bun.lock	[email protected] (npm) is affected by GHSA-p634-w6r4-rjp2	Dependencies (osv-scanner)
medium	`osv/GHSA-p77w-8qqv-26rm`	bun.lock	[email protected] (npm) is affected by GHSA-p77w-8qqv-26rm; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-p88m-4jfj-68fv`	bun.lock	[email protected] (npm) is affected by GHSA-p88m-4jfj-68fv	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	bun.lock	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	bun.lock	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-q8mj-m7cp-5q26`	bun.lock	[email protected] (npm) is affected by GHSA-q8mj-m7cp-5q26; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-q8wf-6r8g-63ch`	bun.lock	[email protected] (npm) is affected by GHSA-q8wf-6r8g-63ch; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-qp7p-654g-cw7p`	bun.lock	[email protected] (npm) is affected by GHSA-qp7p-654g-cw7p; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-qx2v-qp2m-jg93`	bun.lock	[email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-rj75-hqrm-r3gf`	bun.lock	[email protected] (npm) is affected by GHSA-rj75-hqrm-r3gf; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-rmxm-3fg6-px4f`	bun.lock	@hono/[email protected] (npm) is affected by GHSA-rmxm-3fg6-px4f; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-rpw4-54j3-4h4q`	bun.lock	[email protected] (npm) is affected by GHSA-rpw4-54j3-4h4q; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-rv63-4mwf-qqc2`	bun.lock	[email protected] (npm) is affected by GHSA-rv63-4mwf-qqc2; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-rvq5-wwqv-78pq`	bun.lock	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-rvq5-wwqv-78pq; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-rxp7-6hxx-x8q5`	bun.lock	[email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-v2v4-37r5-5v8g`	bun.lock	[email protected] (npm) is affected by GHSA-v2v4-37r5-5v8g; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-v3r7-h72x-cjcm`	bun.lock	[email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm	Dependencies (osv-scanner)
medium	`osv/GHSA-vwc7-r8mq-g2x9`	bun.lock	[email protected] (npm) is affected by GHSA-vwc7-r8mq-g2x9	Dependencies (osv-scanner)
medium	`osv/GHSA-w5vr-8v7q-w6rv`	bun.lock	[email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-w62v-xxxg-mg59`	bun.lock	[email protected] (npm) is affected by GHSA-w62v-xxxg-mg59; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-w74x-v6f9-j3xg`	bun.lock	[email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-w9m9-85wc-3x92`	bun.lock	[email protected] (npm) is affected by GHSA-w9m9-85wc-3x92; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-wfc6-r584-vfw7`	bun.lock	[email protected] (npm) is affected by GHSA-wfc6-r584-vfw7; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-wgpf-jwqj-8h8p`	bun.lock	[email protected] (npm) is affected by GHSA-wgpf-jwqj-8h8p; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-wwfh-h76j-fc44`	bun.lock	[email protected] (npm) is affected by GHSA-wwfh-h76j-fc44; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-x5fp-wj9c-mxmx`	bun.lock	[email protected] (npm) is affected by GHSA-x5fp-wj9c-mxmx; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-xgm2-5f3f-mvvc`	bun.lock	[email protected] (npm) is affected by GHSA-xgm2-5f3f-mvvc; also in yarn.lock	Dependencies (osv-scanner)
medium	`osv/GHSA-xrhx-7g5j-rcj5`	bun.lock	[email protected] (npm) is affected by GHSA-xrhx-7g5j-rcj5; also in yarn.lock	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:108	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:109	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:114	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:114	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/author.ts:118	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:121	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:124	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/author.ts:138	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/author.ts:139	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/author.ts:139	Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:139	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:139	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:140	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:141	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:142	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/author.ts:152	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/author.ts:47	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:49	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/author.ts:54	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/author.ts:57	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:58	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:63	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:91	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/author.ts:96	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/compare.ts:31	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/compare.ts:32	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/compare.ts:33	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/compare.ts:45	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/compare.ts:46	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:218	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:244	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:247	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:327	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:373	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:375	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:427	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/control.ts:429	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/dashboard.ts:44	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/dashboard.ts:45	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:108	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:135	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:136	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:45	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/freeze.ts:49	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:54	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:55	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:55	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:58	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/freeze.ts:82	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:82	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:85	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:85	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:87	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:89	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:89	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:94	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:96	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:96	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/freeze.ts:98	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/generate.ts:70	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/generate.ts:71	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/generate.ts:71	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/generate.ts:72	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/generate.ts:73	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/generate.ts:74	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/generate.ts:75	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/generate.ts:76	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:106	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:114	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:115	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:117	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:117	Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:117	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:117	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:126	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:128	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:154	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:157	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:163	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:168	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:176	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:177	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:177	Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:177	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:177	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:178	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:179	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/holdout.ts:190	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:206	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/holdout.ts:209	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:212	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:213	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:213	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:216	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:229	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:229	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:231	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:231	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:233	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:235	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:235	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:238	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:240	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:240	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:242	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:252	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:272	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:273	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:300	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:301	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:312	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:314	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:325	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:325	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:326	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:331	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:336	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:340	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:364	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:417	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:418	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:473	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:515	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:516	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:518	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/holdout.ts:533	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:551	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:555	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:556	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:562	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:583	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:604	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/holdout.ts:607	Detected that function argument `splitDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:607	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:607	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:616	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:617	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:95	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/holdout.ts:96	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/measure.ts:109	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/measure.ts:137	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/measure.ts:241	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/measure.ts:248	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/measure.ts:296	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/report.ts:28	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/report.ts:29	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/report.ts:30	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/report.ts:32	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1011	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1066	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1066	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1169	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1169	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1199	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1199	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1200	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:1200	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:185	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:187	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:190	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:289	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:289	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/run.ts:290	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:294	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:298	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:302	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:345	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:346	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:347	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:349	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:351	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:352	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:353	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:354	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:395	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:469	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:583	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/run.ts:668	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/run.ts:87	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:91	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/cli/run.ts:912	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:92	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/run.ts:995	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/score.ts:37	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/score.ts:43	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/score.ts:44	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/score.ts:48	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/cli/score.ts:89	Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/validate-judge.ts:119	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/validate-judge.ts:46	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/validate-judge.ts:69	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/validate-judge.ts:96	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/cli/validate-judge.ts:98	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/scripts/judge-screen.ts:38	Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/scripts/triage-failures.ts:62	Detected that function argument `corpusDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/scripts/triage-failures.ts:64	Detected that function argument `corpusDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/scripts/triage-failures.ts:64	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/scripts/triage-failures.ts:64	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/scripts/triage-multihop.ts:118	Detected that function argument `logPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:157	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:22	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:23	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:301	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:311	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:319	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:32	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:329	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:33	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:352	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:379	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:386	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:388	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:406	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:482	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:490	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:515	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:547	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:569	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:639	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	packages/mcp/bench/src/dashboard/public/app.js:653	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:101	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:190	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:190	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:191	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:192	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:206	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:229	Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:253	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:253	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:254	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:255	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:260	Detected that function argument `runId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:260	Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:260	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:266	Detected that function argument `runId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:266	Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:266	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:347	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:347	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:348	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:349	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:351	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:356	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:358	Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:365	Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:372	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:382	Detected that function argument `runDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:382	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:421	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:421	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:424	Detected that function argument `runId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/dashboard/reader.ts:424	Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:462	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/reader.ts:464	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/server.ts:110	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/server.ts:110	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/server.ts:111	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/server.ts:111	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/dashboard/server.ts:71	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:19	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:22	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:23	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:23	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:34	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:41	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:56	Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	packages/mcp/bench/src/lib/artifacts.ts:70	Detected that function argument `current` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/artifacts.ts:72	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/artifacts.ts:72	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:100	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:101	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:116	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:121	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:121	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:207	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:243	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/fixture-lock.ts:99	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/holdout-lock.ts:73	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/holdout-lock.ts:74	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/holdout-lock.ts:84	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	packages/mcp/bench/src/lib/holdout-lock.ts:89	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/author.ts:185	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/author.ts:185	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/holdout.ts:559	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/holdout.ts:559	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/holdout.ts:559	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/holdout.ts:701	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/holdout.ts:701	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/validate-judge.ts:172	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/cli/validate-judge.ts:172	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/src/dashboard/public/app.js:386	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/mcp/bench/src/dashboard/public/app.js:386	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/next/app/preview/_components/HslColorPicker.tsx:110	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	packages/next/app/preview/_components/HslColorPicker.tsx:110	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`osv/GHSA-333x-w4r6-6crp`	bun.lock	[email protected] (npm) is affected by GHSA-333x-w4r6-6crp; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-35p6-xmwp-9g52`	bun.lock	[email protected] (npm) is affected by GHSA-35p6-xmwp-9g52	Dependencies (osv-scanner)
low	`osv/GHSA-3g8h-86w9-wvmq`	bun.lock	[email protected] (npm) is affected by GHSA-3g8h-86w9-wvmq; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-3gg2-335m-rxc6`	bun.lock	[email protected] (npm) is affected by GHSA-3gg2-335m-rxc6; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-4x5r-pxfx-6jf8`	bun.lock	@babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-79qm-7rj5-m7r9`	bun.lock	[email protected] (npm) is affected by GHSA-79qm-7rj5-m7r9; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-g8m3-5g58-fq7m`	bun.lock	[email protected] (npm) is affected by GHSA-g8m3-5g58-fq7m	Dependencies (osv-scanner)
low	`osv/GHSA-hm8q-7f3q-5f36`	bun.lock	[email protected] (npm) is affected by GHSA-hm8q-7f3q-5f36; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-r53p-7pc4-xj5r`	bun.lock	[email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r	Dependencies (osv-scanner)
low	`osv/GHSA-v422-hmwv-36x6`	bun.lock	[email protected] (npm) is affected by GHSA-v422-hmwv-36x6; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-vfv6-92ff-j949`	bun.lock	[email protected] (npm) is affected by GHSA-vfv6-92ff-j949; also in yarn.lock	Dependencies (osv-scanner)
low	`osv/GHSA-xhq7-xmqj-769h`	bun.lock	[email protected] (npm) is affected by GHSA-xhq7-xmqj-769h; also in yarn.lock	Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	53
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	4
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	165
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	300
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`a4217b8ea8f5`	`prov-5+qual-2+sec-2`	30%	72	47
2026-11-14	`a4217b8ea8f5`	`prov-4+qual-2+sec-2`	30%	72	47

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/ItsNotCam/june/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/ItsNotCam/june/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/ItsNotCam/june/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/ItsNotCam/june/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/ItsNotCam/june/security.svg)](https://repotrust.synapticcyber.com/r/github.com/ItsNotCam/june/)

Full text report

Repository: https://github.com/ItsNotCam/june
Commit: a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08
Generated: 2026-11-14T14:52:00+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	30	explicit	95%	100%
Code quality	72	adequate	90%	100%
Security	47	poor	85%	100%

AI provenance

Explicit AI attribution on 30% of first-party code added; an estimated 30% including velocity signals.

Explicitly attributed share (lower bound): 29.6%
Unattributed share in AI-consistent velocity bursts: 49.6%
Estimated AI-generated share: 29.6%

AI tool	Attributed commits	Lines added
Claude Code	18	15,991

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 9,709 of 32,015.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.309	2.242	0.14x
Security	4.841	11.342	0.43x

Stylometry index: 0.33 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 21). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-04	30,925	41%
2026-06	23,060	15%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (a1be6b629e62)
Claude Code: trailer 'Co-authored-by: Claude' (1b12b38d6b82)
Claude Code: trailer 'Co-authored-by: Claude' (cac750c3b314)
Claude Code: trailer 'Co-authored-by: Claude' (21d6c2504cea)
Claude Code: trailer 'Co-authored-by: Claude' (52f5d8e5c50b)
Claude Code: trailer 'Co-authored-by: Claude' (3ea7f1e63bff)
Claude Code: trailer 'Co-authored-by: Claude' (5c254d9e57f1)
Claude Code: trailer 'Co-authored-by: Claude' (85de3b7fab76)
Claude Code: trailer 'Co-authored-by: Claude' (53cb8d0e9c10)
Claude Code: trailer 'Co-authored-by: Claude' (9c663637adb8)
Claude Code: trailer 'Co-authored-by: Claude' (1b444570e607)
Claude Code: trailer 'Co-authored-by: Claude' (a0a04b76b184)
Claude Code: trailer 'Co-authored-by: Claude' (9a33f6e11e47)
Claude Code: trailer 'Co-authored-by: Claude' (ac611fc0f43b)
Claude Code: trailer 'Co-authored-by: Claude' (b1975d40b0a0)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.34, CI runs tests; 16% of function code in complex or long functions; 4% duplicated lines. Weakest area: docs.

Area	Score
Complexity (lizard)	63
Duplication	81
Code smells (Opengrep)	71
Tests and CI	82
Documentation	40
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 1,509; mean complexity 2.7, 90th percentile 6; 15 complex and 11 long functions
Duplicated lines: 3.5% of 23,526 compared
Tests: 11,015 test lines for 32,015 source lines (ratio 0.34); CI test commands: bun test; 47% of recent source commits also change tests
Docs missing or thin: license, contributing, changelog

Most complex functions:

Security

Security posture is poor: 165 known vulnerabilities in 30 dependencies; 19 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	35
Vulnerable dependencies (OSV)	3
CI workflows (zizmor)	63
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 165 in 30 packages (critical 6, high 67, medium 80, low 12)
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
critical	`osv/GHSA-2464-fhr4-w9xw`: [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw; also in yarn.lock	bun.lock
critical	`osv/GHSA-2xp9-vwfh-vxw4`: [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4; also in yarn.lock	bun.lock
critical	`osv/GHSA-673q-mjm6-r5xr`: [email protected] (npm) is affected by GHSA-673q-mjm6-r5xr; also in yarn.lock	bun.lock
critical	`osv/GHSA-p293-qw3h-jr36`: [email protected] (npm) is affected by GHSA-p293-qw3h-jr36; also in yarn.lock	bun.lock
critical	`osv/GHSA-vcvr-r3jv-pc5j`: [email protected] (npm) is affected by GHSA-vcvr-r3jv-pc5j; also in yarn.lock	bun.lock
critical	`osv/GHSA-jqcg-44mw-7w3h`: [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h; also in yarn.lock	bun.lock
high	`opengrep/javascript.lang.security.detect-child-process`: Detected calls to child_process from a function argument `juneBin`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]	packages/mcp/bench/cli/health.ts:112
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:146
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:146
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:157
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `chip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:157
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:289
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `meta.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:289
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:332
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:332
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:352
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tr.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:352
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:403
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `$("detail-body").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:403
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:406
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `$("detail-body").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:406
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:568
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `view.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:568
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:653
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `wrap.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	packages/mcp/bench/src/dashboard/public/app.js:653

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 32,015; test lines: 11,015

Language	Lines
TypeScript	41,682
JavaScript	792
Shell	373
SQL	147
Python	36