Leaderboard github.com

LeadGrowGTM/research-process-builder

Build validated web research processes through self-annealing loops. 138 patterns tested, 90%+ accuracy. Works with Claude Code, Clay, any AI agent.

View repository ↗
Python
★ 70
commit 2b49aac264ac
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

66%

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

55/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

62/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

66% explicit

Explicit AI attribution on 66% of first-party code added; an estimated 66% including velocity signals.

How the score is built

Explicitly attributed share66%
Unattributed share in AI-pace bursts26%
Estimated AI-generated share66%
AI tool configuration files6
Work sessions at AI pace13
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.26

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	149	59,648	2026-03-05	2026-10-06

Lines added per month all AI-attributed share

2026-034,543 · 100% AI
2026-0417,021 · 85% AI
2026-059,034 · 88% AI
2026-063,810 · 100% AI
2026-0835,870 · 35% AI
2026-095,833 · 40% AI
2026-1014,099 · 100% AI

Findings in AI-attributed lines vs the rest

From git blame: 35,304 lines trace to AI-attributed commits, 15,249 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	1.30	0.53	2.48×
Security	1.08	0.39	2.74×

Evidence by analyzer

Explicit AI attributionok26 items

attributed_commit_share: 51.6%
attributed_commits: 149
attributed_loc: 59,648
attributed_loc_share: 66.1%
commits: 289
effective_loc: 90,210
tools_detected: 1

AI tool configurationok6 items

artifacts: 6
earliest_adoption: 2026-05-09
tools_configured: 2
workflow_agents: 0

Commit velocityok13 items

excluded_import_loc: 14,515
flagged_loc: 42,318
flagged_loc_share: 55.9%
flagged_units: 13
max_loc_per_hour: 10,548.23
measured_loc: 75,695
median_loc_per_hour: 302.40
pr_timed_units: 20
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 88

Release velocityskipped

Coding styleok4 items

count:assistant_voice: 0
count:emoji_in_code: 18
count:narrated_steps: 4
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 4
files:narrated_steps: 1
files:placeholder: 0
index: 0.26
lines_scanned: 50,553
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.36
per_kloc:narrated_steps: 0.08
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 35,304
blame_failures: 0
files_blamed: 229
other_lines: 15,249
quality:ai_findings: 46
quality:ai_per_kloc: 1.30
quality:other_findings: 8
quality:other_per_kloc: 0.53
quality:ratio: 2.48
security:ai_findings: 38
security:ai_per_kloc: 1.08
security:other_findings: 6
security:other_per_kloc: 0.39
security:ratio: 2.74

Code quality

55 weak

Code quality is weak: test-to-source ratio 0.58, no CI test run detected; 31% of function code in complex or long functions; 6% duplicated lines. Weakest area: type safety.

How the score is built

Complexity39
Duplication70
Lint and smells69
Tests and CI55
Documentation65
Type safety15
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 138
function_nloc: 31,694
functions: 2,032
long_functions: 17
many_param_functions: 17
mean_ccn: 5.43
p90_ccn: 12
risky_nloc_share: 31.3%

Duplication (jscpd)ok10 items

compared_lines: 39,055
duplicated_lines: 2,327
duplicated_share: 6.0%
files: 229

Lintok

category:best-practice: 30
category:correctness: 16
category:maintainability: 8
findings: 54
scanned_lines: 50,144
weighted_findings: 75.25

Tests and CIok

check:ci_present: no
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: yes
check:tests_cochange: yes
ci_files: 0
cochange_commits: 176
cochange_share: 68.8%
source_lines: 50,553
test_lines: 29,230
test_ratio: 0.58

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 123

Type safetyok1 item

TypeScript strict type checking: trigger/tsconfig.json trigger/tsconfig.json

check:low_escape_density: no
check:strict_config: no
escapes: 409
escapes_per_kloc: 8.31

Security

62 weak

Security posture is weak: 0 possible secret(s) in the tree, 1 only in history; 14 known vulnerabilities in 7 dependencies; 10 high-severity SAST findings. Weakest area: posture.

How the score is built

Secrets82
Static analysis (SAST)89
Vulnerable dependencies43
CI workflowsnot measured
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 9
declared: 9
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 1
secrets_low_confidence: 0
secrets_nonprod: 1

Static analysis (opengrep)ok

findings: 44
findings_high: 10
findings_low: 4
findings_medium: 30
parse_errors: 2
scanned_lines: 50,144
weighted_findings: 16.65

Dependencies (osv-scanner)ok

penalty: 51
vulnerabilities: 14
vulnerable_packages: 7
vulns_critical: 0
vulns_high: 6
vulns_low: 1
vulns_medium: 7
vulns_unknown: 0

CI workflows (zizmor)skipped

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 10.0%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

30 high69 medium15 low

Severity	Rule	Location	Message	Tool
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	prompts/extract-companies-batch/score.py:116	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/agent_research.py:239	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/agent_research.py:249	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/anneal.py:347	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/backfill_article_text.py:136	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/company_enrichment/_locking.py:40	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	scripts/company_enrichment/dossier_runner.py:82	Using 'stream.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'stream.name' is used. Use '.flush()' or close the file before using 'stream.name'.	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	scripts/company_enrichment/evidence.py:394	Using 'stream.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'stream.name' is used. Use '.flush()' or close the file before using 'stream.name'.	Lint
high	`opengrep/python.lang.maintainability.useless-inner-function`	scripts/company_enrichment_icp_loop.py:427	function `inventor` is defined inside a function but never used	Lint
high	`opengrep/python.lang.maintainability.useless-inner-function`	scripts/company_enrichment_icp_loop.py:432	function `checker` is defined inside a function but never used	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/motorica_collect_copy_e1.py:118	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/pattern_tester.py:756	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/pipeline_base.py:904	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	scripts/trigger_run.py:85	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	enrichments/news-product-launches/run.py:174	Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	scripts/company_enrichment/adapters/meta_ads.py:108	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.lang.security.use-defused-xml`	scripts/company_enrichment/cli.py:21	The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/company_enrichment/cli.py:419	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/game_signals_extract.py:277	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args`	scripts/game_signals_extract.py:278	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/motorica_append_linkedin_to_sheet.py:32	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/motorica_collect_copy_e1.py:48	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	scripts/motorica_collect_copy_e2.py:63	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`osv/GHSA-3f7j-7jwc-fxfj`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-3f7j-7jwc-fxfj	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	Dependencies (osv-scanner)
high	`osv/GHSA-96hv-2xvq-fx4p`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p	Dependencies (osv-scanner)
high	`osv/GHSA-ggr8-5vv4-36mx`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-ggr8-5vv4-36mx	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	Dependencies (osv-scanner)
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`	trigger/run-dev.mjs:9	Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute...	Static analysis (opengrep)
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	prompts/extract-companies-batch/score.py:160	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	scripts/_run_copy_worker_e2.py:9	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/backfill_domains.py:387	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.correctness.use-sys-exit`	scripts/check_pl_table.py:16	Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/check_pl_table.py:21	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/check_pl_table.py:25	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/company_enrichment/adapters/known_url_scrape.py:117	Is "is_quality_failure" a function or an attribute? If it is a function, you may have meant module.is_quality_failure() because module.is_quality_failure is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/company_enrichment/providers.py:188	Is "is_b2b" a function or an attribute? If it is a function, you may have meant profile.is_b2b() because profile.is_b2b is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/company_enrichment/providers.py:190	Is "is_ecommerce_or_cpg" a function or an attribute? If it is a function, you may have meant profile.is_ecommerce_or_cpg() because profile.is_ecommerce_or_cpg is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	scripts/company_enrichment/runner.py:277	Is "is_saturated" a function or an attribute? If it is a function, you may have meant tracker.is_saturated() because tracker.is_saturated is always true.	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	scripts/eval_iter.py:27	`return` only makes sense inside a function	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/pipeline_base.py:1050	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/pipeline_base.py:191	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/pipeline_base.py:261	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/pipeline_base.py:277	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/pipeline_base.py:312	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/pipeline_base.py:552	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/probe_lgenrich.py:30	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/probe_lgenrich.py:34	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/probe_lgenrich_raw.py:20	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/product_launch_ph_pipeline.py:124	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/product_launch_ph_pipeline.py:194	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/push_lgenrich_key_to_trigger.py:37	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/raisingfi_ingest.py:333	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/recall_analysis.py:33	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	scripts/recall_analysis.py:70	`return` only makes sense inside a function	Lint
medium	`opengrep/python.requests.best-practice.use-raise-for-status`	scripts/trigger_run.py:35	There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a...	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	trigger/drain-enrichment-backlog.mjs:43	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	trigger/drain-enrichment-backlog.mjs:44	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	trigger/src/pipeline/game-signals-pipeline.ts:121	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	trigger/src/pipeline/scrape.ts:99	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/backfill_article_text.py:45	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/backfill_article_text.py:62	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/backfill_article_text.py:79	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/backfill_article_text.py:96	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/adapters/google_ads.py:142	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/adapters/meta_ads.py:377	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/adapters/meta_ads.py:393	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/adapters/parallel.py:214	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/adapters/parallel_task.py:276	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/adapters/serper.py:154	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.django.security.injection.tainted-url-host`	scripts/company_enrichment/ads_collect.py:81	User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/cli.py:370	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/cli.py:485	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/company_enrichment/page_signals.py:129	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/python.django.security.injection.tainted-url-host`	scripts/company_enrichment/runner.py:136	User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this...	Static analysis (opengrep)
medium	`opengrep/python.django.security.injection.tainted-url-host`	scripts/company_enrichment/signal_collection.py:474	User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.insecure-hash-algorithm-md5`	scripts/pattern_tester.py:240	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	scripts/product_launch_ph_pipeline.py:66	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`gitleaks/sourcegraph-access-token`	searches/raw-results-master.json:57854	Possible sourcegraph-access-token secret in history (commit 9c8e2c046c); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`osv/GHSA-58qx-3vcg-4xpx`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-58qx-3vcg-4xpx	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv	Dependencies (osv-scanner)
medium	`osv/GHSA-qxg6-89mg-rqv8`	trigger/package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22	Dependencies (osv-scanner)
medium	`osv/GHSA-vfpm-58rq-9qcg`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-vfpm-58rq-9qcg	Dependencies (osv-scanner)
medium	`osv/GHSA-xp26-3454-mjgp`	trigger/package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-xp26-3454-mjgp	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.audit.detect-redos`	trigger/src/pipeline/additional-signals.ts:123	Detected the use of a regular expression `^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	trigger/src/pipeline/brave-source.ts:107	RegExp() called with a `round` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	trigger/src/pipeline/brave-source.ts:33	RegExp() called with a `phrase` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	trigger/src/pipeline/brave-source.ts:47	RegExp() called with a `domain` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	trigger/src/pipeline/brave-source.ts:85	RegExp() called with a `phrase` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	trigger/src/pipeline/brave-source.ts:91	RegExp() called with a `value` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-redos`	trigger/src/pipeline/domain-lookup.ts:357	Detected the use of a regular expression `^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-redos`	trigger/src/pipeline/filters.ts:111	Detected the use of a regular expression `^\S+-based\s+(?:\S+\s+){0,4}?(?:startup\|start-up\|firm\|company\|platform)\s+` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-redos`	trigger/src/pipeline/filters.ts:113	Detected the use of a regular expression `^(?:\S+\s+){1,5}?(?:startup\|start-up\|firm\|platform\|company)\s+` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-redos`	trigger/src/pipeline/taxonomy.ts:220	Detected the use of a regular expression `^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-redos`	trigger/src/sec-form-d-daily.ts:110	Detected the use of a regular expression `^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	trigger/src/sec-form-d-daily.ts:63	RegExp() called with a `tag` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/scripts/discovery-eval.ts:191	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/scripts/discovery-eval.ts:191	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/scripts/discovery-eval.ts:207	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/scripts/discovery-eval.ts:207	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/src/pipeline/domain-lookup.ts:231	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/src/pipeline/domain-lookup.ts:231	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/src/pipeline/product-launches-news.ts:229	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/src/pipeline/product-launches-news.ts:229	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	trigger/src/pipeline/round-configs.ts:38	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	cloudflare/clay-game-callback/src/index.ts:29	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`gitleaks/curl-auth-header`	trigger/README.md:350	Possible curl-auth-header secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	trigger/get-run-logs.mjs:29	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`osv/GHSA-9jrq-w75r-8gcw`	trigger/package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw	Dependencies (osv-scanner)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	trigger/scripts/list-env-names.mjs:4	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	trigger/scripts/trigger-task.mjs:10	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	54
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	14
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	44
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	2

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`2b49aac264ac`	`prov-5+qual-2+sec-2`	66%	55	62
2026-11-14	`2b49aac264ac`	`prov-4+qual-2+sec-2`	66%	55	62

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/LeadGrowGTM/research-process-builder/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/LeadGrowGTM/research-process-builder/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/LeadGrowGTM/research-process-builder/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/LeadGrowGTM/research-process-builder/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/LeadGrowGTM/research-process-builder/security.svg)](https://repotrust.synapticcyber.com/r/github.com/LeadGrowGTM/research-process-builder/)

Full text report

Repository: https://github.com/LeadGrowGTM/research-process-builder
Commit: 2b49aac264ac3305ce1a7fc1c6663c58189baa06
Generated: 2026-11-14T14:52:00+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	66	explicit	95%	100%
Code quality	55	weak	90%	100%
Security	62	weak	85%	100%

AI provenance

Explicit AI attribution on 66% of first-party code added; an estimated 66% including velocity signals.

Explicitly attributed share (lower bound): 66.1%
Unattributed share in AI-consistent velocity bursts: 26.4%
Estimated AI-generated share: 66.1%

AI tool	Attributed commits	Lines added
Claude Code	149	59,648

AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 35,304 of 50,553.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	1.303	0.525	2.48x
Security	1.076	0.393	2.74x

Stylometry index: 0.26 per 1,000 lines (narrated steps 4, placeholders 0, assistant phrasing 0, emoji 18). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-03	4,543	100%
2026-04	17,021	85%
2026-05	9,034	88%
2026-06	3,810	100%
2026-08	35,870	35%
2026-09	5,833	40%
2026-10	14,099	100%

Evidence

Claude Code: trailer 'Co-authored-by: Claude' (2b49aac264ac)
Claude Code: trailer 'Co-authored-by: Claude' (ce955eb75814)
Claude Code: trailer 'Co-authored-by: Claude' (91174c861907)
Claude Code: trailer 'Co-authored-by: Claude' (7edb899fbf3d)
Claude Code: trailer 'Co-authored-by: Claude' (4bc907f7013f)
Claude Code: trailer 'Co-authored-by: Claude' (e3cf840b2800)
Claude Code: trailer 'Co-Authored-By: Claude' (f17ca9440887)
Claude Code: trailer 'Co-authored-by: Claude' (401535682a31)
Claude Code: trailer 'Co-authored-by: Claude' (63adb71fe5ad)
Claude Code: trailer 'Co-authored-by: Claude' (b19fef4dcab2)
Claude Code: trailer 'Co-Authored-By: Claude' (fc3f7562af77)
Claude Code: trailer 'Co-Authored-By: Claude' (6ec5e22e9fc3)
Claude Code: trailer 'Co-Authored-By: Claude' (655427b13926)
Claude Code: PR description attribution (90a4404c6034)
Claude Code: trailer 'Co-Authored-By: Claude' (7d48c3987b13)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.58, no CI test run detected; 31% of function code in complex or long functions; 6% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	39
Duplication	70
Code smells (Opengrep)	69
Tests and CI	55
Documentation	65
Type safety	15
Process (Scorecard review/maintenance)	n/a

Functions: 2,032; mean complexity 5.4, 90th percentile 12; 138 complex and 17 long functions
Duplicated lines: 6.0% of 39,055 compared
Tests: 29,230 test lines for 50,553 source lines (ratio 0.58); CI test commands: none detected; 69% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 0 possible secret(s) in the tree, 1 only in history; 14 known vulnerabilities in 7 dependencies; 10 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	82
Static analysis (Opengrep)	89
Vulnerable dependencies (OSV)	43
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 14 in 7 packages (critical 0, high 6, medium 7, low 1)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	enrichments/news-product-launches/run.py:174
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	scripts/company_enrichment/adapters/meta_ads.py:108
high	`opengrep/python.lang.security.use-defused-xml`: The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low]	scripts/company_enrichment/cli.py:21
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/company_enrichment/cli.py:419
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/game_signals_extract.py:277
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args`: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]	scripts/game_signals_extract.py:278
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/motorica_append_linkedin_to_sheet.py:32
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/motorica_collect_copy_e1.py:48
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	scripts/motorica_collect_copy_e2.py:63
high	`opengrep/javascript.lang.security.audit.spawn-shell-true`: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]	trigger/run-dev.mjs:9
high	`osv/GHSA-ggr8-5vv4-36mx`: [email protected] (npm) is affected by GHSA-ggr8-5vv4-36mx	trigger/package-lock.json
high	`osv/GHSA-68fv-2mgg-jv7q`: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	trigger/package-lock.json
high	`osv/GHSA-3f7j-7jwc-fxfj`: [email protected] (npm) is affected by GHSA-3f7j-7jwc-fxfj	trigger/package-lock.json
high	`osv/GHSA-587h-7wmj-h5pm`: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	trigger/package-lock.json
high	`osv/GHSA-96hv-2xvq-fx4p`: [email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p	trigger/package-lock.json
high	`osv/GHSA-mrhx-c7xc-m3w5`: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	trigger/package-lock.json
medium	`gitleaks/sourcegraph-access-token`: Possible sourcegraph-access-token secret in history (commit 9c8e2c046c); removed from the current tree but still retrievable	searches/raw-results-master.json:57854
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/backfill_article_text.py:45
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/backfill_article_text.py:62
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/backfill_article_text.py:79
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/backfill_article_text.py:96
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/company_enrichment/adapters/google_ads.py:142
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/company_enrichment/adapters/meta_ads.py:377
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/company_enrichment/adapters/meta_ads.py:393
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]	scripts/company_enrichment/adapters/parallel.py:214

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 50,553; test lines: 29,230

Language	Lines
Python	58,591
TypeScript	19,830
JavaScript	953
SQL	409