Leaderboard github.com
Muriel2Horak/core-platform
Core platform
AI provenance
0%
possible
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
62/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
37/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% possible
Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts48%
- Estimated AI-generated share0%
- AI tool configuration files1
- Work sessions at AI pace22
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)13.46
Lines added per month all AI-attributed share
- 2025-0933,876 · 0% AI
- 2025-10147,356 · 0% AI
- 2025-113,999 · 0% AI
- 2026-016,460 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 712
- effective_loc
- 191,691
- tools_detected
- 0
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2025-10-25
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok15 items
- 4,964 lines of first-party code in ~1.8h (2,743 lines/hour, 2 commit session)
- 14,146 lines of first-party code in ~5.7h (2,486 lines/hour, 17 commit session)
- 5,629 lines of first-party code in ~2.5h (2,298 lines/hour, 8 commit session)
- 9,857 lines of first-party code in ~5.8h (1,693 lines/hour, 34 commit session)
- 13,827 lines of first-party code in ~8.8h (1,564 lines/hour, 26 commit session)
- 2,734 lines of first-party code in ~2.0h (1,339 lines/hour, 2 commit session)
- 5,677 lines of first-party code in ~4.5h (1,253 lines/hour, 6 commit session)
- 2,434 lines of first-party code in ~2.0h (1,247 lines/hour, 1 commit session)
- 2,847 lines of first-party code in ~2.3h (1,218 lines/hour, 10 commit session)
- 2,060 lines of first-party code in ~1.7h (1,193 lines/hour, 2 commit session)
- 3,121 lines of first-party code in ~2.9h (1,080 lines/hour, 8 commit session)
- 1,021 lines of first-party code in ~1.1h (920 lines/hour, 1 commit session)
- 3,839 lines of first-party code in ~5.2h (740 lines/hour, 10 commit session)
- 2,668 lines of first-party code in ~3.7h (718 lines/hour, 2 commit session)
- 2,823 lines of first-party code in ~4.0h (706 lines/hour, 1 commit session)
- excluded_import_loc
- 51,587
- flagged_loc
- 92,536
- flagged_loc_share
- 66.6%
- flagged_units
- 22
- max_loc_per_hour
- 2,743.38
- measured_loc
- 138,915
- median_loc_per_hour
- 205.33
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 136
Release velocityskipped
Coding styleok8 items
- step-by-step narration comment: // First, get client UUID
- placeholder or demo-only phrasing: // Note: This is a simplified version - in real implementation,
- assistant-style phrasing left in code: * Key features: - Per-entity locks (not global) - Automatic lock cleanup - Fair
- step-by-step narration comment: // Step 1: Create backup if file exists
- step-by-step narration comment: // Step 2: Write to temp file
- step-by-step narration comment: // Step 3: Validate temp file
- step-by-step narration comment: // Step 4: Atomic move
- step-by-step narration comment: // Step 5: Delete backup on success
- count:assistant_voice
- 2
- count:emoji_in_code
- 2,518
- count:narrated_steps
- 31
- count:placeholder
- 4
- files:assistant_voice
- 2
- files:emoji_in_code
- 368
- files:narrated_steps
- 8
- files:placeholder
- 4
- index
- 13.46
- lines_scanned
- 96,728
- per_kloc:assistant_voice
- 0.02
- per_kloc:emoji_in_code
- 26.03
- per_kloc:narrated_steps
- 0.32
- per_kloc:placeholder
- 0.04
Code quality
62 weak
Code quality is weak: test-to-source ratio 0.21, no CI test run detected; 24% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity49
- Duplication62
- Lint and smells79
- Tests and CI55
- Documentation60
- Type safety95
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- Profile in frontend/src/components/Profile.jsx: complexity 48, 518 lines
- RoleDetailDialog in frontend/src/components/Roles/RoleDetailDialog.jsx: complexity 33, 267 lines
- UserEditPage in frontend/src/pages/Admin/UserEditPage.tsx: complexity 32, 210 lines
- renderNavItem in frontend/src/shared/ui/SidebarNav.tsx: complexity 32, 149 lines
- UserDirectory in frontend/src/components/UserDirectory.jsx: complexity 31, 413 lines
- Layout in frontend/src/components/Layout.jsx: complexity 30, 499 lines
- handleMessage in frontend/src/lib/workflow/WorkflowCollaborationClient.ts: complexity 29, 51 lines
- FormField in frontend/src/shared/ui/FormField.tsx: complexity 27, 125 lines
- FrontendLogsController::enrichLogEntry in backend/src/main/java/cz/muriel/core/controller/FrontendLogsController.java: complexity 24, 69 lines
- WorkflowAiValidator::validateWorkflow in backend/src/main/java/cz/muriel/core/metamodel/validator/WorkflowAiValidator.java: complexity 23, 52 lines
- complex_functions
- 39
- function_nloc
- 41,158
- functions
- 3,048
- long_functions
- 45
- many_param_functions
- 2
- mean_ccn
- 2.71
- p90_ccn
- 6
- risky_nloc_share
- 23.6%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: backend/src/main/java/com/platform/workflow/versioning/WorkflowVersionService.java:89 and backend/src/main/java/com/platform/workflow/versioning/WorkflowVersionService.java:128
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/auth/AuthController.java:423 and backend/src/main/java/cz/muriel/core/controller/FrontendLogsController.java:294
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/auth/KeycloakAdminService.java:84 and backend/src/main/java/cz/muriel/core/auth/KeycloakAdminService.java:135
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/config/PermissionConfig.java:30 and backend/src/main/java/cz/muriel/core/dto/UiCapabilitiesDto.java:40
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/controller/UserDirectoryController.java:169 and backend/src/main/java/cz/muriel/core/controller/UserDirectoryController.java:273
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/controller/admin/StudioAdminController.java:228 and backend/src/main/java/cz/muriel/core/controller/admin/StudioAdminController.java:402
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/controller/admin/StudioAdminController.java:444 and backend/src/main/java/cz/muriel/core/controller/admin/WorkflowAdminController.java:178
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/controller/admin/WorkflowAdminController.java:166 and backend/src/main/java/cz/muriel/core/workflow/WorkflowExecutionService.java:188
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/dto/UserCreateRequest.java:20 and backend/src/main/java/cz/muriel/core/dto/UserUpdateRequest.java:13
- 6+ duplicated lines: backend/src/main/java/cz/muriel/core/entity/GroupEntity.java:93 and backend/src/main/java/cz/muriel/core/metamodel/util/DeterministicUuidGenerator.java:66
- compared_lines
- 65,262
- duplicated_lines
- 5,293
- duplicated_share
- 8.1%
- files
- 669
Lintok
- category:best-practice
- 62
- category:correctness
- 80
- findings
- 142
- scanned_lines
- 94,884
- weighted_findings
- 88.25
Tests and CIok4 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/quality-gates-nightly.yml
.github/workflows/quality-gates-nightly.yml - CI config: .github/workflows/quality-gates-pr.yml
.github/workflows/quality-gates-pr.yml - CI config: .github/workflows/quality-gates-release.yml
.github/workflows/quality-gates-release.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 4
- cochange_commits
- 125
- cochange_share
- 24.0%
- source_lines
- 96,728
- test_lines
- 20,131
- test_ratio
- 0.21
Documentationok2 items
- README.md
README.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- no
- check:license
- no
- check:readme
- yes
- readme_lines
- 537
Type safetyok1 item
- TypeScript strict type checking: bff/tsconfig.json
bff/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 99
- escapes_per_kloc
- 4.58
Security
37 poor
Security posture is poor: 3 possible secret(s) in the tree, 2 only in history; 185 known vulnerabilities in 42 dependencies; 5 high-severity SAST findings; 1 high-severity workflow issues. Weakest area: dependencies.
How the score is built
- Secrets7
- Static analysis (SAST)92
- Vulnerable dependencies1
- CI workflows33
- Security posture80
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 65
- declared
- 65
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 3
- secrets_history
- 2
- secrets_low_confidence
- 9
- secrets_nonprod
- 25
Static analysis (opengrep)ok
- findings
- 72
- findings_high
- 5
- findings_low
- 12
- findings_medium
- 55
- parse_errors
- 7
- scanned_lines
- 94,884
- weighted_findings
- 22.10
Dependencies (osv-scanner)ok
- penalty
- 281
- vulnerabilities
- 185
- vulnerable_packages
- 42
- vulns_critical
- 1
- vulns_high
- 85
- vulns_low
- 7
- vulns_medium
- 92
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 33
- findings_high
- 1
- findings_low
- 0
- findings_medium
- 32
- penalty
- 67.20
- workflows
- 4
Security postureok3 items
- Security policy: SECURITY.md
SECURITY.md - Dependency updates: .github/dependabot.yml
.github/dependabot.yml - bff/package.json has no lockfile alongside it (unpinned dependencies)
bff/package.json
- check:dependency_updates
- yes
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- no
- signed_commit_share
- 1.0%
- unpinned_manifests
- 1
Release downloadsok1 item
- gives an archive password
README.md
- binary_assets
- 0
- signals
- 1
- suspicious
- 0
Findings
1 critical96 high244 medium130 low
471 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-5xrq-8626-4rwp |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp | Dependencies (osv-scanner) |
| high | opengrep/typescript.lang.correctness.useless-ternary |
frontend/src/shared/ui/AppButton.tsx:191 | It looks like no matter how typeof children === 'string' && children.includes('...') is evaluated, this expression returns children. This is probably a copy-paste error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
scripts/backlog/lib/yaml_parser.py:63 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/java.lang.security.audit.formatted-sql-string |
backend/src/main/java/cz/muriel/core/entities/MetamodelCrudService.java:127 | Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a... | Static analysis (opengrep) |
| high | opengrep/java.lang.security.audit.formatted-sql-string |
backend/src/main/java/cz/muriel/core/entities/MetamodelCrudService.java:337 | Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
backend/src/main/java/cz/muriel/core/presence/config/WebSocketConfig.java:18 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
backend/src/main/java/cz/muriel/core/presence/config/WebSocketConfig.java:19 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
docker/frontend/Dockerfile:31 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | gitleaks/curl-auth-user |
docker/grafana/scripts/init-orgs.sh:7 | Possible curl-auth-user secret in the current tree | Secrets (gitleaks) |
| high | osv/GHSA-28wg-ghj8-5hjv |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-2v37-7h3g-55p8 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-6g55-p6wh-862q |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-6g55-p6wh-862q; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-c2c7-rcm5-vvqj |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj; also in frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-mw96-cpmx-2vgc |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc | Dependencies (osv-scanner) |
| high | osv/GHSA-p9ff-h696-f583 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-p9ff-h696-f583 | Dependencies (osv-scanner) |
| high | osv/GHSA-r28c-9q8g-f849 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-r28c-9q8g-f849; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-v2wj-q39q-566r |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-v2wj-q39q-566r | Dependencies (osv-scanner) |
| high | osv/GHSA-xwg4-73v4-xw9w |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| high | gitleaks/private-key |
docker/ssl/key.pem:1 | Possible private-key secret in the current tree | Secrets (gitleaks) |
| high | osv/GHSA-23c5-xmqv-rm74 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 | Dependencies (osv-scanner) |
| high | osv/GHSA-23c5-xmqv-rm74 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-25h7-pfq9-p65f |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-35jp-ww65-95wh |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-35jp-ww65-95wh | Dependencies (osv-scanner) |
| high | osv/GHSA-3g43-6gmg-66jw |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3g43-6gmg-66jw | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-3ppc-4f35-3m26 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 | Dependencies (osv-scanner) |
| high | osv/GHSA-3ppc-4f35-3m26 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-3pq3-5fj3-cg6v |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3pq3-5fj3-cg6v | Dependencies (osv-scanner) |
| high | osv/GHSA-43fc-jf86-j433 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-43fc-jf86-j433 | Dependencies (osv-scanner) |
| high | osv/GHSA-49rj-9fvp-4h2h |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-49rj-9fvp-4h2h | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-542g-h47m-68v8 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-542g-h47m-68v8 | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-62hf-57xw-28j9 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-62hf-57xw-28j9 | Dependencies (osv-scanner) |
| high | osv/GHSA-6chq-wfr3-2hj9 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-6chq-wfr3-2hj9 | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-777c-7fjr-54vf |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-777c-7fjr-54vf | Dependencies (osv-scanner) |
| high | osv/GHSA-7r86-cg39-jmmj |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj | Dependencies (osv-scanner) |
| high | osv/GHSA-7r86-cg39-jmmj |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-8646-j5j9-6r62 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-8646-j5j9-6r62 | Dependencies (osv-scanner) |
| high | osv/GHSA-8x6r-g9mw-2r78 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-8x6r-g9mw-2r78 | Dependencies (osv-scanner) |
| high | osv/GHSA-96hv-2xvq-fx4p |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-chx6-hx7r-mcp5 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-chx6-hx7r-mcp5 | Dependencies (osv-scanner) |
| high | osv/GHSA-hfxv-24rg-xrqf |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-hfxv-24rg-xrqf | Dependencies (osv-scanner) |
| high | osv/GHSA-hmw2-7cc7-3qxx |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx; also in tools/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-j5f8-grm9-p9fc |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-j5f8-grm9-p9fc | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mw96-cpmx-2vgc |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc | Dependencies (osv-scanner) |
| high | osv/GHSA-p92q-9vqr-4j8v |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-p92q-9vqr-4j8v | Dependencies (osv-scanner) |
| high | osv/GHSA-p9ff-h696-f583 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-p9ff-h696-f583 | Dependencies (osv-scanner) |
| high | osv/GHSA-pf86-5x62-jrwf |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-pf86-5x62-jrwf | Dependencies (osv-scanner) |
| high | osv/GHSA-pmwg-cvhr-8vh7 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-pmwg-cvhr-8vh7 | Dependencies (osv-scanner) |
| high | osv/GHSA-px8p-9vwx-vf98 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-px8p-9vwx-vf98 | Dependencies (osv-scanner) |
| high | osv/GHSA-q8qp-cvcw-x6jj |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-q8qp-cvcw-x6jj | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-qwww-vcr4-c8h2 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-qwww-vcr4-c8h2 | Dependencies (osv-scanner) |
| high | osv/GHSA-r5fr-rjxr-66jc |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-r5fr-rjxr-66jc | Dependencies (osv-scanner) |
| high | osv/GHSA-rf6f-7fwh-wjgh |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-rxv8-25v2-qmq8 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-rxv8-25v2-qmq8 | Dependencies (osv-scanner) |
| high | osv/GHSA-v2wj-q39q-566r |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-v2wj-q39q-566r | Dependencies (osv-scanner) |
| high | gitleaks/private-key |
ssl/key.pem:1 | Possible private-key secret in the current tree | Secrets (gitleaks) |
| high | osv/GHSA-587h-7wmj-h5pm |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-mw96-cpmx-2vgc |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc | Dependencies (osv-scanner) |
| high | osv/GHSA-5j98-mcp5-4vw2 |
tools/naming-lint/package-lock.json | [email protected] (npm) is affected by GHSA-5j98-mcp5-4vw2 | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-35jp-ww65-95wh |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-35jp-ww65-95wh | Dependencies (osv-scanner) |
| high | osv/GHSA-3g43-6gmg-66jw |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-3g43-6gmg-66jw | Dependencies (osv-scanner) |
| high | osv/GHSA-43fc-jf86-j433 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-43fc-jf86-j433 | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-62hf-57xw-28j9 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-62hf-57xw-28j9 | Dependencies (osv-scanner) |
| high | osv/GHSA-6chq-wfr3-2hj9 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-6chq-wfr3-2hj9 | Dependencies (osv-scanner) |
| high | osv/GHSA-777c-7fjr-54vf |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-777c-7fjr-54vf | Dependencies (osv-scanner) |
| high | osv/GHSA-hfxv-24rg-xrqf |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-hfxv-24rg-xrqf | Dependencies (osv-scanner) |
| high | osv/GHSA-j5f8-grm9-p9fc |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-j5f8-grm9-p9fc | Dependencies (osv-scanner) |
| high | osv/GHSA-p92q-9vqr-4j8v |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-p92q-9vqr-4j8v | Dependencies (osv-scanner) |
| high | osv/GHSA-pf86-5x62-jrwf |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-pf86-5x62-jrwf | Dependencies (osv-scanner) |
| high | osv/GHSA-pmwg-cvhr-8vh7 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-pmwg-cvhr-8vh7 | Dependencies (osv-scanner) |
| high | osv/GHSA-q8qp-cvcw-x6jj |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-q8qp-cvcw-x6jj | Dependencies (osv-scanner) |
| medium | opengrep/java.lang.correctness.no-string-eqeq |
backend/src/main/java/cz/muriel/core/auth/security/HmacUtils.java:71 | Strings should not be compared with '=='. This is a reference comparison operator. Use '.equals()' instead. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/DesignSystem.jsx:35 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/DesignSystemDemo.jsx:75 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Groups/GroupMembersDialog.jsx:189 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Profile.jsx:63 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/Reporting/ExplorerGrid.stories.tsx:119 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Reporting/ReportingPage.tsx:170 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Reporting/ReportingPage.tsx:171 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Reporting/ReportingPage.tsx:172 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Reporting/ReportingPage.tsx:34 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Roles/CompositeRoleBuilder.jsx:272 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Roles/CompositeRoleBuilder.jsx:278 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/Studio/EntityEditor.tsx:261 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/CreateUserDialog.jsx:329 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/CreateUserDialog.jsx:339 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/EditUserDialog.jsx:453 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/EditUserDialog.jsx:459 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/EditUserDialog.jsx:513 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/EditUserDialog.jsx:525 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/EditUserDialog.jsx:549 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/components/Users/EditUserDialog.jsx:561 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/hooks/usePermissions.js:180 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/Admin/MonitoringPage.tsx:22 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/pages/Admin/SyncHistoryPage.jsx:146 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/Examples/KanbanPage.jsx:150 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/Examples/KanbanPage.jsx:151 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/Examples/KanbanPage.tsx:178 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/pages/Examples/KanbanPage.tsx:179 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/shared/ui/AppButton.tsx:187 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/shared/ui/FormField.tsx:126 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
frontend/src/shared/ui/GlassPaper.tsx:36 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:105 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:106 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:183 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:184 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:189 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:200 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:210 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:241 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:253 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:254 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:255 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:308 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:309 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:310 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:311 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:344 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:345 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:346 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:36 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:37 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:38 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:39 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:40 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:52 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:63 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:64 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:65 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/test-trigger-sync.sh:66 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/bash.lang.best-practice.useless-cat |
scripts/vault/bootstrap-vault.sh:143 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
themes/core-material/src/Account.tsx:126 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
themes/core-material/src/account-entry.tsx:31 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
themes/core-material/src/login-entry.tsx:37 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/bash.curl.security.curl-pipe-bash |
.devcontainer/scripts/post-create.sh:13 | Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or... | Static analysis (opengrep) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:117 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:140 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:163 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:178 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:63 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:8 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:33 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | gitleaks/curl-auth-user |
.github/workflows/grafana-provisioning.yml:111 | Possible curl-auth-user secret in history (commit ab1d81cf98); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:146 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:15 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:185 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:218 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:280 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:336 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:385 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:426 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-nightly.yml:61 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:147 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:15 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:187 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:223 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:283 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:343 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:401 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-pr.yml:61 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:149 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:18 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:188 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:221 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:284 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:317 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:357 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/quality-gates-release.yml:64 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/GHSA-xwmg-2g98-w7v9 |
backend/pom.xml | com.nimbusds:[email protected] (Maven) is affected by GHSA-xwmg-2g98-w7v9 | Dependencies (osv-scanner) |
| medium | opengrep/java.lang.security.audit.bad-hexa-conversion |
backend/src/main/java/cz/muriel/core/reporting/support/MetamodelSpecService.java:364 | 'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format("%02X", ...)' instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/java.lang.security.audit.bad-hexa-conversion |
backend/src/main/java/cz/muriel/core/service/KeycloakEventProjectionService.java:804 | 'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format("%02X", ...)' instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/java.lang.security.audit.bad-hexa-conversion |
backend/src/main/java/cz/muriel/core/service/UiCapabilitiesService.java:121 | 'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format("%02X", ...)' instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/java.spring.security.audit.spring-actuator-dangerous-endpoints-enabled |
backend/src/main/resources/application.properties:181 | Spring Boot Actuators "health,info,prometheus,metrics" are enabled. Depending on the actuators, this can pose a significant security risk. Please double-check if the actuators are needed and properly secured. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/java.spring.security.audit.spring-actuator-dangerous-endpoints-enabled |
backend/src/main/resources/application.properties:322 | Spring Boot Actuators "health,info,metrics,prometheus" are enabled. Depending on the actuators, this can pose a significant security risk. Please double-check if the actuators are needed and properly secured. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/dockerfile.security.secret-in-build-arg |
docker/frontend/Dockerfile:10 | Docker build time arguments are not suited for secrets, because the argument values are saved with the image. Running `docker image history` on the image will show information on how the image was built, including arguments. If these... | Static analysis (opengrep) |
| medium | gitleaks/curl-auth-user |
docker/grafana/scripts/entrypoint.sh:126 | Possible curl-auth-user secret in history (commit ebfdf021c5); removed from the current tree but still retrievable | Secrets (gitleaks) |
| medium | osv/GHSA-3v7f-55p6-f55p |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p; also in frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-4w7w-66w2-5vf9 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-93m4-6634-74q7 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-93m4-6634-74q7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fx2h-pf6j-xcff |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff | Dependencies (osv-scanner) |
| medium | osv/GHSA-fxqj-rqcc-2cmp |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-qx2v-qp2m-jg93 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-v6wh-96g9-6wx3 |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
e2e/helpers/scenes.ts:56 | RegExp() called with a `textOrSelector` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/esbuild.mjs:16 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/esbuild.mjs:34 | Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/esbuild.mjs:35 | Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/esbuild.mjs:37 | Detected that function argument `src` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/esbuild.mjs:39 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/esbuild.mjs:39 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/esbuild.mjs:40 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/esbuild.mjs:40 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/esbuild.mjs:44 | Detected that function argument `src` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/esbuild.mjs:44 | Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/esbuild.mjs:44 | Detected that function argument `src` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/final-cleanup.cjs:11 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/final-cleanup.cjs:11 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/final-cleanup.cjs:12 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/final-cleanup.cjs:193 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/final-cleanup.cjs:259 | Detected that function argument `{ file, fix }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/final-cleanup.cjs:260 | Detected that function argument `{ file, fix }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/final-cleanup.cjs:263 | Detected that function argument `{ file, fix }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/final-cleanup.cjs:65 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/final-cleanup.cjs:8 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/fix-all-eslint-issues.cjs:11 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/fix-all-eslint-issues.cjs:11 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-all-eslint-issues.cjs:12 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-all-eslint-issues.cjs:131 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-all-eslint-issues.cjs:27 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-all-eslint-issues.cjs:8 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
frontend/fix-all-eslint-issues.cjs:97 | RegExp() called with a `component` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
frontend/fix-all-eslint-issues.cjs:98 | RegExp() called with a `component` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
frontend/fix-all-eslint-issues.cjs:99 | RegExp() called with a `component` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-react-imports.cjs:14 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/fix-react-imports.cjs:17 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/fix-react-imports.cjs:17 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-react-imports.cjs:18 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-react-imports.cjs:33 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-react-imports.cjs:94 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-unused-imports.cjs:119 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/fix-unused-imports.cjs:12 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/fix-unused-imports.cjs:12 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-unused-imports.cjs:13 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-unused-imports.cjs:29 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/fix-unused-imports.cjs:9 | Detected that function argument `currentDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | osv/GHSA-2g4f-4pwh-qvx6 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-2j2x-hqr9-3h42 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-2j2x-hqr9-3h42 | Dependencies (osv-scanner) |
| medium | osv/GHSA-337j-9hxr-rhxg |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-337j-9hxr-rhxg | Dependencies (osv-scanner) |
| medium | osv/GHSA-3p68-rc4w-qgx5 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3p68-rc4w-qgx5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3w6x-2g7m-8v23 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-3w6x-2g7m-8v23 | Dependencies (osv-scanner) |
| medium | osv/GHSA-42h9-826w-cgv3 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-42h9-826w-cgv3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-445q-vr5w-6q77 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-445q-vr5w-6q77 | Dependencies (osv-scanner) |
| medium | osv/GHSA-48c2-rrv3-qjmp |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-48c2-rrv3-qjmp; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-48c2-rrv3-qjmp |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-48c2-rrv3-qjmp | Dependencies (osv-scanner) |
| medium | osv/GHSA-4hqw-qxg8-jxx2 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-4hqw-qxg8-jxx2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4w7w-66w2-5vf9 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-58qx-3vcg-4xpx |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-58qx-3vcg-4xpx | Dependencies (osv-scanner) |
| medium | osv/GHSA-5c9x-8gcm-mpgx |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-5c9x-8gcm-mpgx | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-7q8q-rj6j-mhjq |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-7q8q-rj6j-mhjq | Dependencies (osv-scanner) |
| medium | osv/GHSA-82fw-gwwq-j7x9 |
frontend/package-lock.json | @vitest/[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-82fw-gwwq-j7x9 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-898c-q2cr-xwhg |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-898c-q2cr-xwhg | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fr6-4gfg-395g |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-9fr6-4gfg-395g | Dependencies (osv-scanner) |
| medium | osv/GHSA-f22v-gfqf-p8f3 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-f22v-gfqf-p8f3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-f886-m6hf-6m8v |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v | Dependencies (osv-scanner) |
| medium | osv/GHSA-f886-m6hf-6m8v |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-fgmj-fm8m-jvvx |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-fgmj-fm8m-jvvx | Dependencies (osv-scanner) |
| medium | osv/GHSA-fvcv-3m26-pcqx |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-fvcv-3m26-pcqx | Dependencies (osv-scanner) |
| medium | osv/GHSA-fx2h-pf6j-xcff |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-h67p-54hq-rp68 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 | Dependencies (osv-scanner) |
| medium | osv/GHSA-h8fp-f39c-q6mh |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-h8fp-f39c-q6mh | Dependencies (osv-scanner) |
| medium | osv/GHSA-j8rh-479h-cp32 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-j8rh-479h-cp32 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jjmj-jmhj-qwj2 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-jjmj-jmhj-qwj2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jqh4-m9w3-8hp9 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-jqh4-m9w3-8hp9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-m7pr-hjqh-92cm |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-m7pr-hjqh-92cm | Dependencies (osv-scanner) |
| medium | osv/GHSA-mmx7-hfxf-jppx |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mmx7-hfxf-jppx | Dependencies (osv-scanner) |
| medium | osv/GHSA-mwf2-3pr3-8698 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-mwf2-3pr3-8698 | Dependencies (osv-scanner) |
| medium | osv/GHSA-p498-v437-472g |
frontend/package-lock.json | @humanfs/[email protected] (npm) is affected by GHSA-p498-v437-472g | Dependencies (osv-scanner) |
| medium | osv/GHSA-pmv8-rq9r-6j72 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-pmv8-rq9r-6j72 | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in tools/naming-lint/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-qxg6-89mg-rqv8 |
frontend/package-lock.json | @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r4q5-vmmm-2653 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-r4q5-vmmm-2653; also in tools/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-v6wh-96g9-6wx3 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vf2m-468p-8v99 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-vf2m-468p-8v99 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vh66-26gq-q6x8 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-vh66-26gq-q6x8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv | Dependencies (osv-scanner) |
| medium | osv/GHSA-w9j2-pvgh-6h63 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-w9j2-pvgh-6h63 | Dependencies (osv-scanner) |
| medium | osv/GHSA-wrjc-x8rr-h8h6 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-wrjc-x8rr-h8h6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-xx6v-rp6x-q39c |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-xx6v-rp6x-q39c | Dependencies (osv-scanner) |
| medium | osv/GHSA-xxjr-mmjv-4gpg |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-xxjr-mmjv-4gpg | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.incomplete-sanitization |
frontend/src/components/Monitoring/MetricCard.tsx:96 | `metrics.errorRate.replace` method will only replace the first occurrence when used with a string argument ('%'). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization... | Static analysis (opengrep) |
| medium | osv/GHSA-4w7w-66w2-5vf9 |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-67mh-4wv8-2f99 |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-67mh-4wv8-2f99 | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-93m4-6634-74q7 |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-93m4-6634-74q7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fx2h-pf6j-xcff |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-v6wh-96g9-6wx3 |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
tools/grafana-org-admin.ts:157 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
tools/grafana-org-admin.ts:159 | Detected that function argument `orgId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
tools/grafana-org-admin.ts:159 | Detected that function argument `tenantId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
tools/grafana-org-admin.ts:253 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | osv/GHSA-3g3m-2fjr-6pw4 |
tools/naming-lint/package-lock.json | [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
tools/naming-lint/src/lint-kafka.js:88 | Detected the use of a regular expression `^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*){2,}(-retry|-dlq)?$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex... | Static analysis (opengrep) |
| medium | osv/GHSA-3p68-rc4w-qgx5 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-3p68-rc4w-qgx5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3w6x-2g7m-8v23 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-3w6x-2g7m-8v23 | Dependencies (osv-scanner) |
| medium | osv/GHSA-42h9-826w-cgv3 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-42h9-826w-cgv3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-445q-vr5w-6q77 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-445q-vr5w-6q77 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4hqw-qxg8-jxx2 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-4hqw-qxg8-jxx2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-5c9x-8gcm-mpgx |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-5c9x-8gcm-mpgx | Dependencies (osv-scanner) |
| medium | osv/GHSA-7q8q-rj6j-mhjq |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-7q8q-rj6j-mhjq | Dependencies (osv-scanner) |
| medium | osv/GHSA-898c-q2cr-xwhg |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-898c-q2cr-xwhg | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fr6-4gfg-395g |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-9fr6-4gfg-395g | Dependencies (osv-scanner) |
| medium | osv/GHSA-fvcv-3m26-pcqx |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-fvcv-3m26-pcqx | Dependencies (osv-scanner) |
| medium | osv/GHSA-h67p-54hq-rp68 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 | Dependencies (osv-scanner) |
| medium | osv/GHSA-j8rh-479h-cp32 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-j8rh-479h-cp32 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jqh4-m9w3-8hp9 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-jqh4-m9w3-8hp9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-m7pr-hjqh-92cm |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-m7pr-hjqh-92cm | Dependencies (osv-scanner) |
| medium | osv/GHSA-mh29-5h37-fv8m |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-mh29-5h37-fv8m | Dependencies (osv-scanner) |
| medium | osv/GHSA-mmx7-hfxf-jppx |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-mmx7-hfxf-jppx | Dependencies (osv-scanner) |
| medium | osv/GHSA-pmv8-rq9r-6j72 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-pmv8-rq9r-6j72 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vf2m-468p-8v99 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-vf2m-468p-8v99 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vh66-26gq-q6x8 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-vh66-26gq-q6x8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w9j2-pvgh-6h63 |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-w9j2-pvgh-6h63 | Dependencies (osv-scanner) |
| medium | osv/GHSA-xx6v-rp6x-q39c |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-xx6v-rp6x-q39c | Dependencies (osv-scanner) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
backend/start-backend.sh:15 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/backend/start-backend.sh:11 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/backend/start-backend.sh:14 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/backend/start-backend.sh:25 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/grafana/scripts/fetch-jwks.sh:48 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/keycloak/entrypoint.sh:33 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/keycloak/init-realm.sh:18 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/keycloak/init-realm.sh:37 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/keycloak/init-realm.sh:46 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/keycloak/init-realm.sh:50 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/keycloak/init-realm.sh:57 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
docker/keycloak/init-realm.sh:67 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/final-cleanup.cjs:208 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/final-cleanup.cjs:208 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/final-cleanup.cjs:234 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/final-cleanup.cjs:234 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/App.jsx:211 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/App.jsx:211 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/Reporting/ExplorerGrid.stories.tsx:22 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/Reporting/ExplorerGrid.stories.tsx:22 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/Admin/KeycloakSyncPage.jsx:491 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/pages/Admin/KeycloakSyncPage.jsx:491 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/backlog/test_validator.sh:489 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/ci/check-ai-risky-patterns.sh:114 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/ci/check-ai-risky-patterns.sh:68 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/create-service-account.sh:44 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/db/rollback.sh:69 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/db/validate-undo-scripts.sh:13 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/docker/prod-deploy.sh:54 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/docker/staging-deploy.sh:43 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/docker/staging-deploy.sh:50 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:108 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:118 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:130 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:142 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:154 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:43 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:53 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/infra-smoke-test.sh:69 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:115 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:120 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:122 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:131 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:133 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:144 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:148 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:158 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:160 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:163 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:170 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:175 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:179 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:190 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:192 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:195 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:204 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:209 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:211 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:32 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:46 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:58 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:64 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:75 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:77 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:92 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/kc_bootstrap_realm.sh:94 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
scripts/quick-fix.sh:11 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/templates/validate-syntax.sh:21 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/templates/validate-syntax.sh:28 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/test-monitoring-runtime.sh:76 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/test-role-group-sync.sh:143 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/validate-dashboard-structure.sh:95 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/vault/oidc-setup.sh:48 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
tools/naming-lint/src/lint-db.js:75 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
tools/naming-lint/src/lint-db.js:75 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
tools/naming-lint/src/lint-db.js:78 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
tools/naming-lint/src/lint-db.js:78 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | gitleaks/generic-api-key |
.env.backup:27 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
.env.bak:79 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
.env.example:20 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
.env:19 | Possible generic-api-key secret in history (commit 5069de7e27); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
DB_SEPARATE_USERS_PLAN.md:199 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
GRAFANA_PROVISIONING_IMPLEMENTATION.md:321 | Possible curl-auth-user secret in history (commit e0bb5673d8); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
GRAFANA_PROVISIONING_STABLE.md:238 | Possible curl-auth-user secret in history (commit ab1d81cf98); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
GRAFANA_SCENES_TESTS_COMPLETE.md:52 | Possible generic-api-key secret in history (commit 58b6cef415); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
GRAFANA_SSO_DEBUG_SUMMARY.md:86 | Possible curl-auth-user secret in history (commit 3f0f7e66e0); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
GRAFANA_SSO_FIX_SUMMARY.md:259 | Possible curl-auth-user secret in history (commit 3f0f7e66e0); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
MONITORING_COMPLETE.md:89 | Possible curl-auth-user secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
MONITORING_IMPLEMENTATION_COMPLETE.md:101 | Possible curl-auth-user secret in history (commit 45ef0e40cd); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
SECURITY_CONFIG_AUDIT.md:465 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
TESTING_GRAFANA_PROVISIONING.md:262 | Possible curl-auth-user secret in history (commit cbe64322bf); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
backend/src/main/java/cz/muriel/core/backend/config/OpenApiConfig.java:101 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
backlog/EPIC-016-advanced-data-ux-framework/stories/DUX10-layout-sharing-collaboration/README.md:102 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
backlog/EPIC-016-advanced-data-ux-framework/stories/S10-sharing.md:84 | Possible generic-api-key secret in history (commit 09ffd42252); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
backlog/EPIC-016-advanced-data-ux-framework/stories/S10/README.md:84 | Possible generic-api-key secret in history (commit 61b08decbe); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/jwt |
backlog/EPIC-017-modular-architecture/stories/LIC-001-license-jwt-validation/README.md:89 | Possible jwt secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
bff/src/resolvers/index.ts:11 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
bff/src/resolvers/index.ts:25 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
docker/.env:23 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/jwt |
docker/cookie.txt:5 | Possible jwt secret in history (commit a37a0bae65); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docker/docker-compose.yml:85 | Possible generic-api-key secret in history (commit 185cadbfdd); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
docker/grafana/PROVISIONING_README.md:131 | Possible curl-auth-user secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docker/keycloak/realm-admin.json:219 | Possible generic-api-key secret in history (commit e1057e6f26); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docker/keycloak/realm-core-platform.json:89 | Possible generic-api-key secret in history (commit d0b1175c48); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docker/keycloak/realm-core-platform.template.json:90 | Possible generic-api-key secret in history (commit d0b1175c48); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | osv/GHSA-4x5r-pxfx-6jf8 |
docker/package-lock.json | @babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8; also in frontend/package-lock.json; also in themes/core-material/package-lock.json | Dependencies (osv-scanner) |
| low | osv/GHSA-9jrq-w75r-8gcw |
docker/package-lock.json | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
docs/API_DOCUMENTATION.md:46 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
docs/GRAFANA_USER_SYNC_ARCHITECTURE.md:168 | Possible curl-auth-user secret in history (commit ddf174d26b); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/jwt |
docs/MODULE_LICENSING.md:124 | Possible jwt secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docs/MODULE_LICENSING.md:161 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docs/MONITORING_BFF_ARCHITECTURE.md:591 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
docs/MONITORING_DEPLOYMENT_GUIDE.md:223 | Possible curl-auth-user secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-header |
docs/SECURITY_MIGRATION_GUIDE.md:100 | Possible curl-auth-header secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docs/TROUBLESHOOTING.md:148 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | osv/GHSA-84g9-w2xq-vcv6 |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-84g9-w2xq-vcv6 | Dependencies (osv-scanner) |
| low | osv/GHSA-9jrq-w75r-8gcw |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | osv/GHSA-xhjh-pmcv-23jw |
frontend/package-lock.json | [email protected] (npm) is affected by GHSA-xhjh-pmcv-23jw | Dependencies (osv-scanner) |
| low | opengrep/javascript.browser.security.js-open-redirect-from-function |
frontend/src/app/layouts/AppShell.tsx:217 | The application accepts potentially user-controlled input `item` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/components/Groups.jsx:95 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.browser.security.js-open-redirect-from-function |
frontend/src/components/Layout.jsx:187 | The application accepts potentially user-controlled input `tenantKey` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/components/Reporting/ExplorerGrid.jsx:65 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/components/Roles.jsx:142 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/components/Roles.jsx:149 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/hooks/useWorkflowCollaboration.ts:77 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/hooks/useWorkflowCollaboration.ts:82 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/pages/Admin/WorkflowDesignerPage.tsx:91 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
frontend/src/pages/Admin/WorkflowDesignerPage.tsx:98 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | osv/GHSA-9jrq-w75r-8gcw |
themes/core-material/package-lock.json | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | osv/GHSA-xhjh-pmcv-23jw |
tools/package-lock.json | [email protected] (npm) is affected by GHSA-xhjh-pmcv-23jw | Dependencies (osv-scanner) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 142 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 33 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 185 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 72 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 39 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 05a15d048a20 | prov-5+qual-2+sec-2 | 0% | 62 | 37 |
| 2026-11-14 | 05a15d048a20 | prov-4+qual-2+sec-2 | 0% | 62 | 37 |
Full text report
- Repository: https://github.com/Muriel2Horak/core-platform
- Commit:
05a15d048a20587585d9ddb352dca98a195eb5c9 - Generated: 2026-11-14T14:52:01+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 62 | weak | 90% | 100% |
| Security | 37 | poor | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 48.3%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: github-copilot
-
Stylometry index: 13.46 per 1,000 lines (narrated steps 31, placeholders 4, assistant phrasing 2, emoji 2518). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-09 | 33,876 | 0% |
| 2025-10 | 147,356 | 0% |
| 2025-11 | 3,999 | 0% |
| 2026-01 | 6,460 | 0% |
Evidence
- 4,964 lines of first-party code in ~1.8h (2,743 lines/hour, 2 commit session) (66d7b0d1a823)
- 14,146 lines of first-party code in ~5.7h (2,486 lines/hour, 17 commit session) (14a753cf6ad1)
- 5,629 lines of first-party code in ~2.5h (2,298 lines/hour, 8 commit session) (e95f281a2e94)
- 9,857 lines of first-party code in ~5.8h (1,693 lines/hour, 34 commit session) (944d4cefabac)
- .github/copilot-instructions.md (github-copilot configuration) (.github/copi)
- 13,827 lines of first-party code in ~8.8h (1,564 lines/hour, 26 commit session) (12c4be57bb1b)
- 2,734 lines of first-party code in ~2.0h (1,339 lines/hour, 2 commit session) (7dbedc4067b0)
- 5,677 lines of first-party code in ~4.5h (1,253 lines/hour, 6 commit session) (84dbd46ac94e)
- 2,434 lines of first-party code in ~2.0h (1,247 lines/hour, 1 commit session) (8617379825b3)
- 2,847 lines of first-party code in ~2.3h (1,218 lines/hour, 10 commit session) (141fb9e9e7f8)
- 2,060 lines of first-party code in ~1.7h (1,193 lines/hour, 2 commit session) (adb5c9fa26a5)
- 3,121 lines of first-party code in ~2.9h (1,080 lines/hour, 8 commit session) (672ea5156d8c)
- 1,021 lines of first-party code in ~1.1h (920 lines/hour, 1 commit session) (f17ce4f3927e)
- 3,839 lines of first-party code in ~5.2h (740 lines/hour, 10 commit session) (16a0a2a356c3)
- 2,668 lines of first-party code in ~3.7h (718 lines/hour, 2 commit session) (4fe112fbecb3)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.21, no CI test run detected; 24% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 49 |
| Duplication | 62 |
| Code smells (Opengrep) | 79 |
| Tests and CI | 55 |
| Documentation | 60 |
| Type safety | 95 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 3,048; mean complexity 2.7, 90th percentile 6; 39 complex and 45 long functions
- Duplicated lines: 8.1% of 65,262 compared
- Tests: 20,131 test lines for 96,728 source lines (ratio 0.21); CI test commands: none detected; 24% of recent source commits also change tests
- Docs missing or thin: license, contributing
Most complex functions:
- Profile in frontend/src/components/Profile.jsx: complexity 48, 518 lines
- RoleDetailDialog in frontend/src/components/Roles/RoleDetailDialog.jsx: complexity 33, 267 lines
- UserEditPage in frontend/src/pages/Admin/UserEditPage.tsx: complexity 32, 210 lines
- renderNavItem in frontend/src/shared/ui/SidebarNav.tsx: complexity 32, 149 lines
- UserDirectory in frontend/src/components/UserDirectory.jsx: complexity 31, 413 lines
Security
Security posture is poor: 3 possible secret(s) in the tree, 2 only in history; 185 known vulnerabilities in 42 dependencies; 5 high-severity SAST findings; 1 high-severity workflow issues. Weakest area: dependencies.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 7 |
| Static analysis (Opengrep) | 92 |
| Vulnerable dependencies (OSV) | 1 |
| CI workflows (zizmor) | 33 |
| Posture (policy, updates, signing, lockfiles) | 80 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 185 in 42 packages (critical 1, high 85, medium 92, low 7)
-
Posture checks passed: security policy, dependency updates; missing: signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5xrq-8626-4rwp: [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp |
frontend/package-lock.json |
| high | gitleaks/curl-auth-user: Possible curl-auth-user secret in the current tree |
docker/grafana/scripts/init-orgs.sh:7 |
| high | gitleaks/private-key: Possible private-key secret in the current tree |
docker/ssl/key.pem:1 |
| high | gitleaks/private-key: Possible private-key secret in the current tree |
ssl/key.pem:1 |
| high | opengrep/java.lang.security.audit.formatted-sql-string: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. [confidence medium] |
backend/src/main/java/cz/muriel/core/entities/MetamodelCrudService.java:127 |
| high | opengrep/java.lang.security.audit.formatted-sql-string: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. [confidence medium] |
backend/src/main/java/cz/muriel/core/entities/MetamodelCrudService.java:337 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
backend/src/main/java/cz/muriel/core/presence/config/WebSocketConfig.java:18 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
backend/src/main/java/cz/muriel/core/presence/config/WebSocketConfig.java:19 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
docker/frontend/Dockerfile:31 |
| high | osv/GHSA-73wf-gq98-2v4g: [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g |
docker/package-lock.json |
| high | osv/GHSA-c83g-rgw3-j3cx: [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx |
docker/package-lock.json |
| high | osv/GHSA-28wg-ghj8-5hjv: [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv; also in frontend/package-lock.json; also in themes/core-material/package-lock.json |
docker/package-lock.json |
| high | osv/GHSA-2v37-7h3g-55p8: [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8; also in frontend/package-lock.json; also in themes/core-material/package-lock.json |
docker/package-lock.json |
| high | osv/GHSA-xwg4-73v4-xw9w: [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w; also in frontend/package-lock.json; also in themes/core-material/package-lock.json |
docker/package-lock.json |
| high | osv/GHSA-c2c7-rcm5-vvqj: [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj; also in frontend/package-lock.json |
docker/package-lock.json |
| high | osv/GHSA-6g55-p6wh-862q: [email protected] (npm) is affected by GHSA-6g55-p6wh-862q; also in frontend/package-lock.json; also in themes/core-material/package-lock.json |
docker/package-lock.json |
| high | osv/GHSA-r28c-9q8g-f849: [email protected] (npm) is affected by GHSA-r28c-9q8g-f849; also in frontend/package-lock.json; also in themes/core-material/package-lock.json |
docker/package-lock.json |
| high | osv/GHSA-mw96-cpmx-2vgc: [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc |
docker/package-lock.json |
| high | osv/GHSA-68fv-2mgg-jv7q: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q; also in frontend/package-lock.json; also in themes/core-material/package-lock.json |
docker/package-lock.json |
| high | osv/GHSA-587h-7wmj-h5pm: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm |
docker/package-lock.json |
| high | osv/GHSA-p9ff-h696-f583: [email protected] (npm) is affected by GHSA-p9ff-h696-f583 |
docker/package-lock.json |
| high | osv/GHSA-v2wj-q39q-566r: [email protected] (npm) is affected by GHSA-v2wj-q39q-566r |
docker/package-lock.json |
| high | osv/GHSA-35jp-ww65-95wh: [email protected] (npm) is affected by GHSA-35jp-ww65-95wh |
frontend/package-lock.json |
| high | osv/GHSA-3g43-6gmg-66jw: [email protected] (npm) is affected by GHSA-3g43-6gmg-66jw |
frontend/package-lock.json |
| high | osv/GHSA-3pq3-5fj3-cg6v: [email protected] (npm) is affected by GHSA-3pq3-5fj3-cg6v |
frontend/package-lock.json |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- readme-download-lure: gives an archive password
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 96,728; test lines: 20,131
| Language | Lines |
|---|---|
| Java | 47,181 |
| TypeScript | 27,494 |
| JavaScript | 21,444 |
| Shell | 16,391 |
| Python | 2,324 |
| SQL | 1,871 |
| HCL | 154 |