Leaderboard github.com
MetrolistGroup/Metrolist
YouTube Music client for Android
AI provenance
0%
explicit
- Confidence
- 72%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
73/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
56/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% explicit
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share0%
- AI tool configuration files2
- Work sessions at AI pace0
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.01
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 3 | 1 | 2026-11-14 | 2026-11-14 |
Lines added per month all AI-attributed share
- 2026-11522,681 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 1 lines trace to AI-attributed commits, 331,955 to others (sampled). Too few lines in one group for a fair comparison. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.03 | — |
| Security | 0.00 | 0.11 | — |
Evidence by analyzer
Explicit AI attributionok4 items
- Claude Code: 3 attributed commits, 1 lines added
- Claude Code: message 'claude.ai/code'
- Claude Code: message 'claude.ai/code'
- Claude Code: message 'claude.ai/code'
- attributed_commit_share
- 30.0%
- attributed_commits
- 3
- attributed_loc
- 1
- attributed_loc_share
- 0.0%
- commits
- 10
- effective_loc
- 522,681
- tools_detected
- 1
AI tool configurationok2 items
- artifacts
- 2
- earliest_adoption
- 2026-11-14
- tools_configured
- 2
- workflow_agents
- 0
Commit velocityok
- excluded_import_loc
- 522,593
- flagged_loc
- 0
- flagged_loc_share
- 0.0%
- flagged_units
- 0
- max_loc_per_hour
- 15
- measured_loc
- 88
- median_loc_per_hour
- 0
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 3
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 0
- releases
- 0
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 12
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 6
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0.01
- lines_scanned
- 492,007
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.02
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 1
- blame_failures
- 0
- files_blamed
- 1,500
- other_lines
- 331,955
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 11
- quality:other_per_kloc
- 0.03
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 38
- security:other_per_kloc
- 0.11
Code quality
73 adequate
Code quality is adequate: test-to-source ratio 0.06, CI runs tests; 18% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity58
- Duplication60
- Lint and smells98
- Tests and CI78
- Documentation85
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- prepareAndPlay in androidApp/src/main/kotlin/com/metrolist/android/playback/ExoPlaybackPlayer.kt: complexity 161, 1038 lines
- leadingVowelFallback in shared/src/commonMain/kotlin/com/metrolist/shared/api/lyrics/romanizer/ThaiRomanizer.kt: complexity 142, 254 lines
- updateByLookAhead in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/LyricsRetiming.kt: complexity 132, 350 lines
- BraccatoWordAnimation in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/words/Braccato.kt: complexity 97, 582 lines
- reduceDcPlayback in shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPlaybackReducer.kt: complexity 84, 174 lines
- handleBinary in shared/src/commonMain/kotlin/com/metrolist/shared/listentogether/ListenTogetherManager.kt: complexity 84, 208 lines
- toFullResolution in shared/src/commonMain/kotlin/com/metrolist/shared/api/lastfm/LastFM.kt: complexity 83, 728 lines
- startUnsafe in shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/FFmpegFrameGrabber.kt: complexity 79, 233 lines
- YTGridItem in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/YTItemCards.kt: complexity 70, 280 lines
- play in shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/AudioPlayer.kt: complexity 69, 176 lines
- complex_functions
- 329
- function_nloc
- 309,413
- functions
- 18,980
- long_functions
- 233
- many_param_functions
- 222
- mean_ccn
- 2.81
- p90_ccn
- 6
- risky_nloc_share
- 17.9%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: androidApp/build.gradle.kts:151 and shared/build.gradle.kts:371
- 6+ duplicated lines: androidApp/src/androidTest/kotlin/com/metrolist/android/playback/PreloadedPlaybackTest.kt:28 and androidApp/src/androidTest/kotlin/com/metrolist/android/playback/PreloadedPlaybackTest.kt:70
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt:155 and desktopApp/src/jvmMain/kotlin/com/metrolist/desktop/backup/DesktopBackupRestoreManager.kt:90
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt:372 and shared/src/jvmSharedMain/kotlin/com/metrolist/shared/backup/ForeignBackupArchive.kt:113
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt:512 and shared/src/iosMain/kotlin/com/metrolist/shared/backup/IosBackupRestoreManager.kt:431
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt:45 and desktopApp/src/jvmMain/kotlin/com/metrolist/desktop/history/HistoryRepository.kt:149
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt:148 and androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt:174
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt:196 and desktopApp/src/jvmMain/kotlin/com/metrolist/desktop/state/playback/ListenTogetherState.kt:95
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt:217 and shared/src/desktopTest/kotlin/com/metrolist/shared/listentogether/ListenTogetherManagerLifecycleTest.kt:1842
- 6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/listentogether/ListenTogetherNotifications.kt:148 and androidApp/src/main/kotlin/com/metrolist/android/listentogether/ListenTogetherNotifications.kt:186
- compared_lines
- 338,439
- duplicated_lines
- 28,507
- duplicated_share
- 8.4%
- files
- 2,248
Lintok
- category:best-practice
- 13
- category:correctness
- 18
- findings
- 31
- scanned_lines
- 491,842
- weighted_findings
- 32.25
Tests and CIok12 items
- CI config: .github/workflows/build-android.yml
.github/workflows/build-android.yml - CI config: .github/workflows/build-desktop-native.yml
.github/workflows/build-desktop-native.yml - CI config: .github/workflows/build-desktop.yml
.github/workflows/build-desktop.yml - CI config: .github/workflows/build-ios.yml
.github/workflows/build-ios.yml - CI config: .github/workflows/llm-triage.yml
.github/workflows/llm-triage.yml - CI config: .github/workflows/release.yml
.github/workflows/release.yml - CI config: .github/workflows/reporter-labels.yml
.github/workflows/reporter-labels.yml - CI config: .github/workflows/reusable-android-build.yml
.github/workflows/reusable-android-build.yml - CI config: .github/workflows/reusable-desktop-linux.yml
.github/workflows/reusable-desktop-linux.yml - CI config: .github/workflows/reusable-desktop-macos.yml
.github/workflows/reusable-desktop-macos.yml - CI runs tests (go test, unittest)
- CI runs linters (go vet, ktlint, shellcheck)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 18
- cochange_commits
- 4
- cochange_share
- 25.0%
- source_lines
- 492,007
- test_lines
- 30,643
- test_ratio
- 0.06
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - docs/changelog.md
docs/changelog.md
- check:changelog
- yes
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 256
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 2
- escapes_per_kloc
- 0.62
Security
56 weak
Security posture is weak: 2 possible secret(s) in the tree, 9 only in history; 36 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: secrets.
How the score is built
- Secrets6
- Static analysis (SAST)96
- Vulnerable dependencies100
- CI workflows38
- Security posture40
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 1
- declared
- 1
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 2
- secrets_history
- 9
- secrets_low_confidence
- 12
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 90
- findings_high
- 36
- findings_low
- 8
- findings_medium
- 46
- parse_errors
- 20
- scanned_lines
- 491,842
- weighted_findings
- 50.20
Dependencies (osv-scanner)ok
- penalty
- 0
- vulnerabilities
- 0
- vulnerable_packages
- 0
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 43
- findings_high
- 3
- findings_low
- 40
- findings_medium
- 0
- penalty
- 58
- workflows
- 18
Security postureok1 item
- Security policy: SECURITY.md
SECURITY.md
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 0
Release downloadsok7 items
- release v14.0.0 ships metrolist-desktop-linux-arm64-14.0.0.AppImage (149 downloads)
- release v14.0.0 ships metrolist-desktop-linux-x64-14.0.0.AppImage (489 downloads)
- release v14.0.0 ships metrolist-desktop-macos-arm64-14.0.0.dmg (83 downloads)
- release v14.0.0 ships metrolist-desktop-macos-x64-14.0.0.dmg (38 downloads)
- release v14.0.0 ships metrolist-desktop-windows-arm64-14.0.0.zip (118 downloads)
- links to file hosts or shorteners: t.me/
README.md - links directly to a downloadable archive or installer
README.md
- binary_assets
- 35
- signals
- 2
- suspicious
- 0
Findings
48 high62 medium77 low
187 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/desktop-native-image/audio.py:31 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/desktop-native-image/run.py:100 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/desktop-native-image/run.py:242 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/desktop-native-image/run.py:87 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/verify_linux_credentials.py:189 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/verify_linux_credentials.py:220 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
scripts/verify_linux_credentials.py:73 | time.sleep() call; did you mean to leave this in? | Lint |
| high | zizmor/github-env |
.github/actions/upload-desktop-sentry/action.yml:17 | dangerous use of environment file [confidence low] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/llm-triage.yml:5 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/reporter-labels.yml:3 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/check_compose_resource_escapes.py:9 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
scripts/check_translation_mechanics.py:114 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/check_translation_mechanics.py:8 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop-native-image/benchmark.py:54 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
scripts/desktop-native-image/benchmark.py:54 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop-native-image/measure-build.py:17 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
scripts/desktop-native-image/measure-build.py:17 | Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop-native-image/measure-build.py:19 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop-native-image/native_image.py:151 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop-native-image/native_image.py:87 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop-native-image/native_image.py:93 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop-native-image/run.py:224 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop_smoke.py:117 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop_smoke.py:142 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop_smoke.py:196 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop_smoke.py:264 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/desktop_smoke.py:313 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/find_unused_strings.py:17 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/find_unused_strings.py:18 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
scripts/find_unused_strings.py:30 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/generate_distribution.py:14 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
scripts/generate_distribution.py:88 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/generate_material_symbols.py:20 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
scripts/propose_distribution.py:11 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/propose_distribution.py:17 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
scripts/propose_distribution.py:36 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/verify_linux_credentials.py:32 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | gitleaks/gcp-api-key |
shared/src/androidMain/kotlin/com/metrolist/shared/youtube/playback/BotGuardPoTokenMinter.kt:404 | Possible gcp-api-key secret in the current tree | Secrets (gitleaks) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPeerPolicy.kt:68 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | gitleaks/gcp-api-key |
shared/src/commonMain/kotlin/com/metrolist/shared/youtube/playback/PageBoundPoTokenMinter.kt:63 | Possible gcp-api-key secret in the current tree | Secrets (gitleaks) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:41 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:54 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:59 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:64 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:16 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:17 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:18 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:19 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
scripts/desktop-native-image/audio.py:34 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.best-practice.hardcoded-tmp-path |
scripts/desktop-native-image/benchmark.py:63 | Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
scripts/desktop-native-image/benchmark.py:63 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.hardcoded-tmp-path |
scripts/desktop-native-image/native_image.py:146 | Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
scripts/desktop-native-image/native_image.py:146 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
scripts/desktop-native-image/package.py:106 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
scripts/desktop-native-image/toolchain.py:84 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
.github/scripts/reporter-labels.cjs:15 | RegExp() called with a `{ github, context }` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:101 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:229 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:247 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:265 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:283 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:301 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:319 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:337 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:355 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:373 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:391 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:409 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:427 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
androidApp/src/main/AndroidManifest.xml:579 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | gitleaks/gcp-api-key |
app/src/main/java/com/metrolist/music/utils/potoken/PoTokenWebView.kt:318 | Possible gcp-api-key secret in history (commit aae4bd8fab); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
app/src/main/java/com/zionhuang/music/SearchResultFragment.java:126 | Possible gcp-api-key secret in history (commit bc47e673cd); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
app/src/main/java/com/zionhuang/music/extractor/YouTubeExtractor.kt:486 | Possible gcp-api-key secret in history (commit aea1d793df); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
app/src/main/java/com/zionhuang/music/extractor/ytextractors/YouTubeSearchExtractor.kt:45 | Possible gcp-api-key secret in history (commit 43fe41e3c8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
app/src/main/java/com/zionhuang/music/youtube/extractors/YouTubeSearchExtractor.kt:13 | Possible gcp-api-key secret in history (commit 001945eccb); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
app/src/main/kotlin/com/metrolist/music/utils/potoken/PoTokenWebView.kt:325 | Possible gcp-api-key secret in history (commit 9811666904); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
innertube/src/main/java/com/malopieds/innertube/models/YouTubeClient.kt:37 | Possible gcp-api-key secret in history (commit f0c5fd1e8b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
innertube/src/main/java/com/metrolist/innertube/models/YouTubeClient.kt:57 | Possible gcp-api-key secret in history (commit 026a1a4a91); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | gitleaks/gcp-api-key |
innertube/src/main/java/com/zionhuang/innertube/models/YouTubeClient.kt:61 | Possible gcp-api-key secret in history (commit 8b67ac6221); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | opengrep/bash.curl.security.curl-pipe-bash |
scripts/deps.sh:26 | Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
scripts/desktop-native-image/toolchain.py:42 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
scripts/generate_mandarin_table.py:23 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
scripts/generate_material_symbols.py:97 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:166 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:174 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:225 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:226 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:426 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/DlnaSessionTest.kt:236 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/DlnaSessionTest.kt:240 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/FcastSessionTest.kt:27 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/cast/FcastSessionTest.kt:85 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectManagerShutdownTest.kt:261 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:101 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:102 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:109 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:66 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:71 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:78 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:83 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:95 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
shared/src/iosMain/resources/kuromoji.js:2899 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
shared/src/iosMain/resources/kuromoji.js:482 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
shared/src/iosMain/resources/kuromoji.js:8197 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
shared/src/iosMain/resources/kuromoji.js:8217 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
shared/src/iosMain/resources/kuromoji.js:8249 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/CastProxyServer.kt:98 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/CastProxyServer.kt:99 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/DlnaSession.kt:407 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/FcastSession.kt:59 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.github/scripts/flatpak-paths.cjs:1 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:5651 | `base.array` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:5899 | `children_info[i++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:5907 | `children_info[i++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:5909 | `children_info[i++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:6294 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:6299 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:6300 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:6305 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:6306 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:6307 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:8346 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:8351 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:8352 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:8357 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:8358 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
shared/src/iosMain/resources/kuromoji.js:8359 | `bytes[j++]` is assigned twice; the first assignment is useless | Lint |
| low | zizmor/self-repository |
.github/actions/prepare-linux-webview/action.yml:14 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-android.yml:39 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-android.yml:45 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-desktop-native.yml:25 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-desktop.yml:47 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-desktop.yml:52 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-desktop.yml:70 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-desktop.yml:87 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-desktop.yml:98 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-ios.yml:33 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build-ios.yml:39 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:107 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:126 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:145 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:165 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:185 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:421 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:82 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-android-build.yml:129 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-android-build.yml:149 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-linux.yml:107 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-linux.yml:71 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-linux.yml:80 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-linux.yml:85 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-macos.yml:105 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-macos.yml:169 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-macos.yml:96 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-native.yml:48 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-native.yml:55 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-native.yml:86 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-verify.yml:54 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-verify.yml:80 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-windows.yml:104 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-windows.yml:127 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-windows.yml:203 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-desktop-windows.yml:95 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-ios-build.yml:177 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/reusable-ios-build.yml:83 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/verify-aur-package.yml:32 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/verify-repository-checks.yml:32 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
app/src/main/cpp/coverart/bento4/Source/Python/utils/wv-request.py:13 | Possible generic-api-key secret in history (commit 489b2a6b0c); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app/src/main/java/com/metrolist/music/utils/potoken/PoTokenWebView.kt:319 | Possible generic-api-key secret in history (commit aae4bd8fab); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
app/src/main/kotlin/com/metrolist/music/utils/potoken/PoTokenWebView.kt:326 | Possible generic-api-key secret in history (commit 9811666904); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
innertube/src/main/java/com/malopieds/innertube/models/YouTubeClient.kt:53 | Possible generic-api-key secret in history (commit f0c5fd1e8b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
innertube/src/main/java/com/metrolist/innertube/InnerTube.kt:253 | Possible generic-api-key secret in history (commit 1804fb0798); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
innertube/src/main/java/com/metrolist/innertube/models/YouTubeClient.kt:53 | Possible generic-api-key secret in history (commit 1804fb0798); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
innertube/src/main/java/com/zionhuang/innertube/InnerTube.kt:210 | Possible generic-api-key secret in history (commit dd00b3d03a); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
innertube/src/main/java/com/zionhuang/innertube/models/YouTubeClient.kt:46 | Possible generic-api-key secret in history (commit dd00b3d03a); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
innertube/src/main/kotlin/com/metrolist/innertube/InnerTube.kt:787 | Possible generic-api-key secret in history (commit bca805962f); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt:152 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt:172 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt:173 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/androidMain/kotlin/com/metrolist/shared/settings/AndroidSecureSettings.kt:159 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
shared/src/androidMain/kotlin/com/metrolist/shared/youtube/playback/BotGuardPoTokenMinter.kt:401 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
shared/src/commonMain/kotlin/com/metrolist/shared/youtube/playback/PageBoundPoTokenMinter.kt:62 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
shared/src/commonTest/kotlin/com/metrolist/shared/api/lyrics/LyprioLyricsProviderTest.kt:967 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:67 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:68 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:82 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
| low | opengrep/kotlin.lang.security.gcm-detection |
shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:83 | GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding... | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 31 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 43 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 90 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 23 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 7d98d60dd317 | prov-5+qual-2+sec-2 | 0% | 73 | 56 |
Full text report
- Repository: https://github.com/MetrolistGroup/Metrolist
- Commit:
7d98d60dd317e703204ec58b35e72f26fffc3ee4 - Generated: 2026-11-14T16:33:53+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 72% | 100% |
| Code quality | 73 | adequate | 90% | 100% |
| Security | 56 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 3 | 1 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 1 of 331,956 (sampled).
Too few lines in one group to compare finding densities.
- Stylometry index: 0.01 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 12). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-11 | 522,681 | 0% |
Evidence
- Claude Code: message 'claude.ai/code' (216442e93ad4)
- Claude Code: message 'claude.ai/code' (8fe84ad68c31)
- Claude Code: message 'claude.ai/code' (8eb76b6c6bae)
- CLAUDE.md (claude-code configuration) (CLAUDE.md)
- AGENTS.md (generic-agent configuration) (AGENTS.md)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.06, CI runs tests; 18% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 58 |
| Duplication | 60 |
| Code smells (Opengrep) | 98 |
| Tests and CI | 78 |
| Documentation | 85 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 18,980; mean complexity 2.8, 90th percentile 6; 329 complex and 233 long functions
- Duplicated lines: 8.4% of 338,439 compared
- Tests: 30,643 test lines for 492,007 source lines (ratio 0.06); CI test commands: go test, unittest; 25% of recent source commits also change tests
- Docs missing or thin: contributing
Most complex functions:
- prepareAndPlay in androidApp/src/main/kotlin/com/metrolist/android/playback/ExoPlaybackPlayer.kt: complexity 161, 1038 lines
- leadingVowelFallback in shared/src/commonMain/kotlin/com/metrolist/shared/api/lyrics/romanizer/ThaiRomanizer.kt: complexity 142, 254 lines
- updateByLookAhead in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/LyricsRetiming.kt: complexity 132, 350 lines
- BraccatoWordAnimation in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/words/Braccato.kt: complexity 97, 582 lines
- reduceDcPlayback in shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPlaybackReducer.kt: complexity 84, 174 lines
Security
Security posture is weak: 2 possible secret(s) in the tree, 9 only in history; 36 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: secrets.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 6 |
| Static analysis (Opengrep) | 96 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | 38 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | gitleaks/gcp-api-key: Possible gcp-api-key secret in the current tree |
shared/src/androidMain/kotlin/com/metrolist/shared/youtube/playback/BotGuardPoTokenMinter.kt:404 |
| high | gitleaks/gcp-api-key: Possible gcp-api-key secret in the current tree |
shared/src/commonMain/kotlin/com/metrolist/shared/youtube/playback/PageBoundPoTokenMinter.kt:63 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
scripts/check_compose_resource_escapes.py:9 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
scripts/check_translation_mechanics.py:8 |
| high | opengrep/python.lang.security.use-defused-xml-parse: The native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using defusedxml. [confidence medium] |
scripts/check_translation_mechanics.py:114 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop-native-image/benchmark.py:54 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
scripts/desktop-native-image/benchmark.py:54 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop-native-image/measure-build.py:17 |
| high | opengrep/python.lang.security.audit.subprocess-shell-true: Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium] |
scripts/desktop-native-image/measure-build.py:17 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop-native-image/measure-build.py:19 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop-native-image/native_image.py:87 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop-native-image/native_image.py:93 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop-native-image/native_image.py:151 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop-native-image/run.py:224 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop_smoke.py:117 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop_smoke.py:142 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop_smoke.py:196 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop_smoke.py:264 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/desktop_smoke.py:313 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
scripts/find_unused_strings.py:17 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
scripts/find_unused_strings.py:18 |
| high | opengrep/python.lang.security.use-defused-xml-parse: The native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using defusedxml. [confidence medium] |
scripts/find_unused_strings.py:30 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
scripts/generate_distribution.py:14 |
| high | opengrep/python.lang.security.use-defused-xml-parse: The native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using defusedxml. [confidence medium] |
scripts/generate_distribution.py:88 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
scripts/generate_material_symbols.py:20 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v14.0.0 ships metrolist-desktop-linux-arm64-14.0.0.AppImage (149 downloads)
- binary-release-asset: release v14.0.0 ships metrolist-desktop-linux-x64-14.0.0.AppImage (489 downloads)
- binary-release-asset: release v14.0.0 ships metrolist-desktop-macos-arm64-14.0.0.dmg (83 downloads)
- binary-release-asset: release v14.0.0 ships metrolist-desktop-macos-x64-14.0.0.dmg (38 downloads)
- binary-release-asset: release v14.0.0 ships metrolist-desktop-windows-arm64-14.0.0.zip (118 downloads)
- readme-download-lure: links to file hosts or shorteners: t.me/
- readme-download-lure: links directly to a downloadable archive or installer
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 492,007; test lines: 30,643
| Language | Lines |
|---|---|
| Kotlin | 503,351 |
| JavaScript | 10,173 |
| Python | 6,599 |
| Java | 975 |
| Shell | 537 |
| C++ | 362 |
| C# | 326 |
| Swift | 162 |
| PowerShell | 111 |
| SQL | 54 |