Leaderboard github.com
Niko1221/Strata
Qwen3.8-Flash-Next on any consumer hardware: one-click install for Windows / Linux. Strata inference engine, OpenAI/Anthropic API on localhost, optional image input.
AI provenance
<1%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
54/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
30/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% explicit
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts47%
- Estimated AI-generated share0%
- AI tool configuration files4
- Work sessions at AI pace71
- Releases at AI pace23
- Coding-style index (1.0+ means possible)0.03
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| OpenAI Codex | 4 | 352 | 2026-09-29 | 2026-10-03 |
| Gemini CLI / Code Assist | 1 | 42 | 2026-10-01 | 2026-10-01 |
| Cursor agent | 1 | 32 | 2026-10-04 | 2026-10-04 |
| GitHub Copilot coding agent | 3 | 7 | 2026-10-01 | 2026-10-07 |
Lines added per month all AI-attributed share
- 2026-09178,081 · 0% AI
- 2026-10511,368 · 0% AI
- 2026-11129,691 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 174 lines trace to AI-attributed commits, 399,825 to others (sampled). Too few lines in one group for a fair comparison. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.40 | — |
| Security | 0.00 | 0.49 | — |
Evidence by analyzer
Explicit AI attributionok13 items
- OpenAI Codex: 4 attributed commits, 352 lines added
- GitHub Copilot coding agent: 3 attributed commits, 7 lines added
- Gemini CLI / Code Assist: 1 attributed commits, 42 lines added
- Cursor agent: 1 attributed commits, 32 lines added
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Cursor agent: trailer 'Co-authored-by: Cursor'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- OpenAI Codex: trailer 'Co-Authored-By: Codex'
- OpenAI Codex: trailer 'Co-Authored-By: Codex'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Gemini CLI / Code Assist: trailer 'Co-authored-by: Gemini'
- OpenAI Codex: trailer 'Co-authored-by: Codex'
- OpenAI Codex: trailer 'Co-authored-by: Codex'
- attributed_commit_share
- 0.2%
- attributed_commits
- 9
- attributed_loc
- 433
- attributed_loc_share
- 0.1%
- commits
- 5,490
- effective_loc
- 819,140
- tools_detected
- 4
AI tool configurationok4 items
- AGENTS.md (generic-agent configuration)
- bench/results/2026-10-10-community-rx-9060-xt/fixtures/merge-windows/AGENTS.md (generic-agent configuration)
- bench/results/2026-10-10-community-rx-9060-xt/fixtures/refactor-orders/AGENTS.md (generic-agent configuration)
- bench/results/2026-10-10-community-rx-9060-xt/fixtures/reservation-workflow/AGENTS.md (generic-agent configuration)
- artifacts
- 4
- earliest_adoption
- 2026-10-01
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok15 items
- 6,689 lines of first-party code in ~1.7h (3,972 lines/hour, 2 commit session)
- 13,948 lines of first-party code in ~3.9h (3,578 lines/hour, 41 commit session)
- 6,742 lines of first-party code in ~1.9h (3,520 lines/hour, 5 commit session)
- 3,956 lines of first-party code in ~1.2h (3,400 lines/hour, 1 commit session)
- 8,567 lines of first-party code in ~2.8h (3,103 lines/hour, 52 commit session)
- 4,253 lines of first-party code in ~1.5h (2,842 lines/hour, 10 commit session)
- 14,568 lines of first-party code in ~5.3h (2,734 lines/hour, 77 commit session)
- 27,676 lines of first-party code in ~10.6h (2,604 lines/hour, 195 commit session)
- 3,072 lines of first-party code in ~1.3h (2,417 lines/hour, 1 commit session)
- 3,614 lines of first-party code in ~1.5h (2,408 lines/hour, 21 commit session)
- 8,686 lines of first-party code in ~3.8h (2,258 lines/hour, 22 commit session)
- 3,251 lines of first-party code in ~1.5h (2,215 lines/hour, 3 commit session)
- 7,323 lines of first-party code in ~4.0h (1,831 lines/hour, 1 commit session)
- 23,309 lines of first-party code in ~13.0h (1,799 lines/hour, 109 commit session)
- 9,342 lines of first-party code in ~5.5h (1,688 lines/hour, 37 commit session)
- excluded_import_loc
- 209,979
- flagged_loc
- 383,129
- flagged_loc_share
- 62.9%
- flagged_units
- 71
- max_loc_per_hour
- 3,972.35
- measured_loc
- 609,161
- median_loc_per_hour
- 117.46
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 944
Release velocityok23 items
- v0.1.29 → v0.1.30: 7,752 lines in 0.23 days (33,527.2 lines/day)
- v0.1.30 → v0.1.31: 7,408 lines in 0.45 days (16,335.3 lines/day)
- v0.1.31 → v0.1.32: 5,619 lines in 0.51 days (10,974.6 lines/day)
- v0.1.38 → v0.1.39: 37,676 lines in 1.5 days (25,175.6 lines/day)
- v0.1.39 → v0.1.40: 23,449 lines in 1.54 days (15,238.9 lines/day)
- v0.1.40.1 → v0.1.40.2: 25,588 lines in 1.08 days (23,662.2 lines/day)
- v0.1.40.4 → v0.1.41: 5,418 lines in 0.21 days (25,800.0 lines/day)
- v0.1.41 → v0.1.42: 21,810 lines in 2.1 days (10,385.8 lines/day)
- v0.1.43.1 → v0.1.44: 30,509 lines in 1.22 days (24,924.1 lines/day)
- v0.1.44.1 → v0.1.45: 16,388 lines in 2.87 days (5,717.0 lines/day)
- v0.1.45 → v0.2.0-beta: 94,651 lines in 2.7 days (35,037.0 lines/day)
- v0.2.0-beta → v0.2.1: 12,431 lines in 0.76 days (16,397.8 lines/day)
- v0.2.1.4 → v0.2.2: 16,851 lines in 0.47 days (36,133.5 lines/day)
- v0.2.2 → v0.2.3: 13,327 lines in 1.87 days (7,135.5 lines/day)
- v0.2.3.1 → v0.2.4: 27,382 lines in 0.53 days (51,873.7 lines/day)
- v0.2.4.2 → v0.2.5: 5,253 lines in 1.05 days (4,998.3 lines/day)
- v0.2.6 → v0.2.7: 33,049 lines in 2.04 days (16,198.6 lines/day)
- v0.2.7 → v0.2.7.1: 7,401 lines in 0.76 days (9,717.9 lines/day)
- v0.2.8 → v0.2.9: 13,311 lines in 1.38 days (9,634.1 lines/day)
- v0.2.9 → v0.2.10: 77,507 lines in 2.84 days (27,259.0 lines/day)
- v0.2.10 → v0.2.11: 19,020 lines in 2.55 days (7,449.4 lines/day)
- v0.2.11 → v0.2.12: 8,934 lines in 1.52 days (5,859.7 lines/day)
- v0.2.12 → v0.2.13: 16,701 lines in 1.93 days (8,667.1 lines/day)
- flagged_releases
- 23
- max_loc_per_day
- 51,873.70
- releases
- 74
Coding styleok8 items
- step-by-step narration comment: // First, as the plugin requires: a second launch ends here after telling the running app to show itself.
- step-by-step narration comment: // First, as the plugin requires: a second window process ends here after telling the open window to show itself.
- assistant-style phrasing left in code: * "Stopped.", "The loop is stopped.", "I have stopped as requested.", "Done, the build passes."
- step-by-step narration comment: # first, in run-all.sh; this is the measurement that actually fills the slots.
- step-by-step narration comment: // first, and never while it is being filled: the pool computes a layer's misses before it starts the next, and a
- step-by-step narration comment: // first, then the AVX-2 one (Zen 2/3, Intel 12th-14th gen). STRATA_NO_IQ512 drops an AVX-512 CPU to the
- step-by-step narration comment: // first, so that both kernels' first calls (their per-device checks and opt-ins) happen inside a stream capture,
- step-by-step narration comment: // first, so a profile that is cold on a small pool empties it below the window floor; the planner must not.
- count:assistant_voice
- 1
- count:emoji_in_code
- 5
- count:narrated_steps
- 10
- count:placeholder
- 0
- files:assistant_voice
- 1
- files:emoji_in_code
- 2
- files:narrated_steps
- 8
- files:placeholder
- 0
- index
- 0.03
- lines_scanned
- 488,201
- per_kloc:assistant_voice
- 0.00
- per_kloc:emoji_in_code
- 0.01
- per_kloc:narrated_steps
- 0.02
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 174
- blame_failures
- 0
- files_blamed
- 1,474
- other_lines
- 399,825
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 160
- quality:other_per_kloc
- 0.40
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 198
- security:other_per_kloc
- 0.49
Code quality
54 weak
Code quality is weak: test-to-source ratio 0.32, CI runs tests; 47% of function code in complex or long functions; 17% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity24
- Duplication36
- Lint and smells54
- Tests and CI81
- Documentation80
- Type safety47
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- main in sycl/src/program/generate.cpp: complexity 3827, 9878 lines
- strata::prefill::Prefill::run_impl in src/prefill/prefill.cpp: complexity 1236, 2824 lines
- api in apps/host/server/index.mjs: complexity 767, 965 lines
- strata::prefill::Prefill::run_impl in sycl/src/prefill/prefill.cpp: complexity 761, 2126 lines
- main in setup.py: complexity 617, 1021 lines
- strata::core::Verifier::record_window in src/core/verify.cpp: complexity 533, 1157 lines
- serve in src/dsv41/ds4_main.cpp: complexity 474, 1343 lines
- strata::prefill::Prefill::lm_run in src/prefill/prefill.cpp: complexity 356, 963 lines
- strata::core::Verifier::record_window in sycl/src/core/verify.cpp: complexity 350, 809 lines
- strata::core::Dflash2Drafter::make_streams in src/core/dflash2.cpp: complexity 335, 826 lines
- complex_functions
- 1,915
- function_nloc
- 359,767
- functions
- 27,295
- long_functions
- 387
- many_param_functions
- 1,003
- mean_ccn
- 5.61
- p90_ccn
- 12
- risky_nloc_share
- 47.0%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: apps/desktop/scripts/cards-e2e.mjs:24 and apps/desktop/scripts/pics-e2e.mjs:30
- 6+ duplicated lines: apps/desktop/scripts/cards-e2e.mjs:33 and apps/desktop/scripts/vision-e2e.mjs:37
- 6+ duplicated lines: apps/desktop/scripts/pics-e2e.mjs:25 and apps/desktop/scripts/vision-e2e.mjs:23
- 6+ duplicated lines: apps/desktop/scripts/stage-control.py:38 and packaging/package_engine.py:50
- 6+ duplicated lines: apps/desktop/scripts/ui-flows.mjs:496 and apps/desktop/scripts/ui-flows.mjs:521
- 6+ duplicated lines: apps/host/scripts/agent-flow-s4b.mjs:32 and apps/host/scripts/agent-flow.mjs:41
- 6+ duplicated lines: apps/host/scripts/agent-flow-s4b.mjs:66 and apps/host/scripts/agent2-flow.mjs:44
- 6+ duplicated lines: apps/host/scripts/agent-http.mjs:2 and apps/host/scripts/agent3-http.mjs:2
- 6+ duplicated lines: apps/host/scripts/agent2-flow.mjs:24 and apps/host/scripts/agent2-tools-flow.mjs:22
- 6+ duplicated lines: apps/host/scripts/approval-flow.mjs:19 and apps/host/scripts/ui-do-drive.mjs:23
- compared_lines
- 438,250
- duplicated_lines
- 75,318
- duplicated_share
- 17.2%
- files
- 2,011
Lintok
- category:best-practice
- 463
- category:correctness
- 541
- category:maintainability
- 95
- findings
- 1,099
- scanned_lines
- 531,826
- weighted_findings
- 1,320.50
Tests and CIok11 items
- CI config: .github/workflows/backends.yml
.github/workflows/backends.yml - CI config: .github/workflows/check.yml
.github/workflows/check.yml - CI config: .github/workflows/docker-images.yml
.github/workflows/docker-images.yml - CI config: .github/workflows/docs.yml
.github/workflows/docs.yml - CI config: .github/workflows/intake.yml
.github/workflows/intake.yml - CI config: .github/workflows/metal-build.yml
.github/workflows/metal-build.yml - CI config: .github/workflows/reopen.yml
.github/workflows/reopen.yml - CI config: .github/workflows/scripts-test.yml
.github/workflows/scripts-test.yml - CI config: .github/workflows/snapshot.yml
.github/workflows/snapshot.yml - CI config: .github/workflows/terminal-minimal-server.yml
.github/workflows/terminal-minimal-server.yml - CI runs tests (pytest, unittest)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 12
- cochange_commits
- 210
- cochange_share
- 61.4%
- source_lines
- 532,323
- test_lines
- 169,138
- test_ratio
- 0.32
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 144
Type safetyok1 item
- TypeScript strict type checking: apps/host/tsconfig.json
apps/host/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 572
- escapes_per_kloc
- 3.15
Security
30 poor
Security posture is poor: 1 possible secret(s) in the tree, 0 only in history; 72 known vulnerabilities in 13 dependencies; 292 high-severity SAST findings; 47 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets11
- Static analysis (SAST)78
- Vulnerable dependencies24
- CI workflows0
- Security posture40
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 45
- declared
- 45
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 1
- secrets_history
- 0
- secrets_low_confidence
- 40
- secrets_nonprod
- 13
Static analysis (opengrep)ok
- findings
- 737
- findings_high
- 292
- findings_low
- 56
- findings_medium
- 389
- parse_errors
- 33
- scanned_lines
- 531,826
- weighted_findings
- 384.45
Dependencies (osv-scanner)ok
- penalty
- 85
- vulnerabilities
- 72
- vulnerable_packages
- 13
- vulns_critical
- 9
- vulns_high
- 36
- vulns_low
- 1
- vulns_medium
- 17
- vulns_unknown
- 9
CI workflows (zizmor)ok
- findings
- 53
- findings_high
- 47
- findings_low
- 0
- findings_medium
- 6
- penalty
- 564
- workflows
- 12
Security postureok2 items
- Security policy: SECURITY.md
SECURITY.md - integrations/harness/profile/package.json has no lockfile alongside it (unpinned dependencies)
integrations/harness/profile/package.json
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 1
Release downloadsok6 items
- release v0.2.13 ships install.ps1 (11998 downloads)
- release v0.2.13 ships Strata-0.2.13-linux-x86_64.AppImage (4874 downloads)
- release v0.2.13 ships Strata-0.2.13-macos-arm64.dmg (2576 downloads)
- release v0.2.13 ships Strata-0.2.13-windows-x64-setup.exe (33335 downloads)
- release v0.2.13 ships strata-control-0.1.59-linux-aarch64.tar.gz (850 downloads)
- 44104 stars in 51 days (865/day)
- binary_assets
- 288
- signals
- 2
- suspicious
- 0
Findings
9 critical576 high40 medium54 low
679 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-m665-v7pm-7grj |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by GHSA-m665-v7pm-7grj | Dependencies (osv-scanner) |
| critical | osv/RUSTSEC-2026-0369 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0369 | Dependencies (osv-scanner) |
| critical | osv/GHSA-fgcw-684q-jj6r |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r | Dependencies (osv-scanner) |
| critical | osv/GHSA-332p-7hrc-92wf |
requirements.txt | [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf | Dependencies (osv-scanner) |
| critical | osv/GHSA-5x8w-8jj5-q52h |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h | Dependencies (osv-scanner) |
| critical | osv/GHSA-8g5g-8vmr-9782 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 | Dependencies (osv-scanner) |
| critical | osv/GHSA-v9pv-5gc8-w2m6 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 | Dependencies (osv-scanner) |
| critical | osv/GHSA-w889-685w-c8fh |
requirements.txt | [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh | Dependencies (osv-scanner) |
| critical | osv/GHSA-xvh5-g6gv-559v |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v | Dependencies (osv-scanner) |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
apps/desktop/scripts/app-close-matrix.py:126 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
apps/desktop/scripts/app-close-matrix.py:149 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
apps/desktop/scripts/app-close-matrix.py:179 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
apps/desktop/scripts/app-close-matrix.py:264 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
apps/desktop/scripts/app-close-matrix.py:290 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
apps/desktop/scripts/app-close-matrix.py:305 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/typescript.lang.correctness.useless-ternary |
apps/host/server/monitor.mjs:178 | It looks like no matter how state.variantId is evaluated, this expression returns 0. This is probably a copy-paste error. | Lint |
| high | opengrep/typescript.lang.correctness.useless-ternary |
apps/host/src/lib/store.ts:2066 | It looks like no matter how options.shown is evaluated, this expression returns body. This is probably a copy-paste error. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/bench_vs_llama.py:112 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/bench_vs_llama.py:139 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/bench_vs_llama.py:61 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
bench/bench_vs_llama.py:95 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-09-29-rtx3090-epyc-milan/data/strata-bench.py:126 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-09-29-rtx3090-epyc-milan/data/strata-bench.py:137 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-09-30-community-rtx-5090/monitor.py:18 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-01-community-2x-rtx-pro-4500/bench.py:29 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-01-community-2x-rtx-pro-4500/spec-sweep/sweep.py:32 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-01-community-2x-rtx-pro-4500/spec-sweep/sweep.py:37 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-01-community-2x-rtx-pro-4500/spec-sweep/sweep.py:47 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-01-community-2x-rtx-pro-4500/spec-sweep/sweep.py:66 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-01-ctx-ladder/run.py:154 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-01-ctx-ladder/run.py:286 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-2x-rtx-pro-4500-engine-0.1.36/bench.py:29 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-2x5060ti/speed_bench.py:62 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-rtx-5090-iq3s/bench.py:119 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-rtx-5090-iq3s/bench.py:136 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-rtx2080ti-11gb/bench_server.py:134 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-rtx2080ti-11gb/common.py:64 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-rtx2080ti-11gb/image_check.py:91 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-rtx2080ti-11gb/monitor.py:28 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-02-community-rtx2080ti-11gb/run_needles.py:46 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-03-ashley-2080ti/IQ3_XXS-1x2080Ti/data/strata-bench.py:126 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-03-ashley-2080ti/IQ3_XXS-1x2080Ti/data/strata-bench.py:137 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-03-community-r9700-windows/benchmark.py:341 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-03-dev-5090/IQ3_S-1x5090/data/strata-bench.py:126 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-03-dev-5090/IQ3_S-1x5090/data/strata-bench.py:137 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-03-dev-5090/strata-bench.py:126 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-03-dev-5090/strata-bench.py:137 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-4090-32gb-ram-512k/check.py:17 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-mi50/monitor_mi50.py:33 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
bench/results/2026-10-04-community-rx-6800-windows/ab.py:145 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
bench/results/2026-10-04-community-rx-6800-windows/ab.py:146 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-rx-6800-windows/ab.py:155 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-rx-6800-windows/run_all.py:48 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
bench/results/2026-10-04-community-rx-6800-windows/run_all.py:59 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
bench/results/2026-10-04-community-rx-6800-windows/run_all.py:60 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-rx-6800-windows/run_all.py:69 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
bench/results/2026-10-04-community-rx-6800-windows/strata_eval.py:113 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-rx-7900-gre/scripts/sample_mem.py:54 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-rx7900xtx-hipblaslt-100500/ab-driver.py:118 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-04-community-rx7900xtx-hipblaslt-100500/ab-driver.py:234 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
bench/results/2026-10-05-community-2x-p40/scripts/bench.py:252 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-05-community-2x-rtx-4060ti/monitor.py:18 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-05-community-2x-rx-6900xt/monitor.py:26 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-05-community-arc-b65/benchmark.py:199 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-05-community-arc-b65/benchy-v1/benchmark.py:110 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-05-community-arc-b65/benchy-v1/benchmark.py:124 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-05-community-rx-6700-xt/monitor_amd.py:34 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-06-community-2x-rtx-pro-4500-engine-0.1.40.1/bench.py:29 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-06-community-rtx-5060ti/monitor.py:18 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-06-community-rtx-5090-laptop/monitor.py:11 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-06-community-rtx4090-opt-ins/conc_bench.py:261 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-06-community-rtx4090-toolcall-hotfix/probe_restart_waiters.py:113 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-07-community-arc-b65-v01402/benchmark.py:203 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-07-community-arc-b65-v01402/frozen-community.py:193 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-07-community-arc-b65-v01402/public-fixtures.py:119 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-07-community-arc-b65-v01402/public-fixtures.py:133 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-07-community-rtx-5080-docker-wsl2/monitor.py:49 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-07-community-xtx-6800xt-1m-helper/quality.py:52 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-08-community-2x-rtx3080-20gb-ud-q4-k-xl-512k-pool/ab/ab.py:72 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
bench/results/2026-10-08-community-r9700-linux/harness/single_gpu.py:112 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-08-community-rtx-5090-laptop-engine-0.1.40.3/monitor.py:11 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-4x-rx-7900-xt/arms2.py:49 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-4x-rx-7900-xt/arms2.py:73 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-gfx1151-ud-iq4xs-0.1.41/scripts/measure.py:61 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-gfx1151-ud-iq4xs-0.1.41/scripts/measure.py:93 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-radeon-pro-vii-16gb/monitor_rpv.py:76 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:257 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:332 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:447 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:768 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:890 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:965 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-10-community-rx-9060-xt/scripts/reproduce_direct.py:24 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-10-community-rx-9070/benchmark.py:361 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-async/strata_ab2.py:158 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-async/strata_ab2.py:173 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-async/strata_ab2.py:188 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-async/strata_ab2.py:206 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-pin-by-need/strata_ab2.py:158 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-pin-by-need/strata_ab2.py:173 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-pin-by-need/strata_ab2.py:188 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-11-community-rtx3090-5600x-arena-pin-by-need/strata_ab2.py:206 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
bench/results/2026-10-12-p40-sm61-kernels/bench.py:23 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/_bridge.py:115 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/_bridge.py:78 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/bridge_e2e.py:120 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/bridge_e2e.py:238 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/bridge_e2e.py:83 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/bridge_tests.py:128 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/bridge_tests.py:174 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/revise_once.py:156 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/tool_flow_e2e.py:383 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/tool_flow_e2e.py:457 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/tool_flow_e2e.py:491 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
integrations/harness/tool_flow_e2e.py:728 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
metal/tools/metal_repack.py:69 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
metal/tools/msl_text_check.py:53 | Using 't.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 't.name' is used. Use '.flush()' or close the file before using 't.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
packaging/smoke_terminal.py:218 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
research/tools/ab-harnesses-2026-10/idle_gpu_ab.py:235 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_128k.py:58 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_concurrent.py:69 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_kvresident.py:51 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_kvresident2.py:47 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_longctx.py:52 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_needle.py:72 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_quality.py:51 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_quality.py:65 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_quality24.py:54 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_turns.py:69 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
research/tools/dgx-spark-2026-10/dgx_warm.py:82 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/images.py:428 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/images.py:567 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/owner_guard.py:65 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/server.py:10621 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
serve/server.py:1203 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
serve/server.py:1207 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/server.py:2171 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/server.py:5310 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/server.py:5467 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/server.py:5620 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
serve/server.py:736 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
serve/telemetry.py:545 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/typescript.lang.correctness.useless-ternary |
serve/web/i18n.js:24 | It looks like no matter how lang === "en" is evaluated, this expression returns "en". This is probably a copy-paste error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
setup.py:10938 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
setup.py:1193 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
setup.py:3206 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
setup.py:3409 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
setup.py:4062 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/bench.py:415 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
strata_cli/bench.py:564 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/bench_standard.py:540 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/bench_standard.py:670 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
strata_cli/bench_standard.py:678 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/cli.py:2111 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
strata_cli/launch/access.py:407 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/launch/access.py:415 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/launch/runner.py:2015 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/launch/runner.py:2085 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_cli/logs.py:135 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/engine_component.py:452 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/procs.py:321 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/procs.py:331 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
strata_control/procs.py:410 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/readiness.py:132 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/runtime.py:1113 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/runtime.py:335 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/runtime.py:653 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/runtime.py:683 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/runtime.py:693 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/runtime.py:903 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/tune_api.py:102 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
strata_control/tune_api.py:281 | Using 'fh.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'fh.name' is used. Use '.flush()' or close the file before using 'fh.name'. | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
strata_control/tune_api.py:81 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/tune_machine.py:225 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
strata_control/tune_session.py:221 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/tune_session.py:272 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/tune_session.py:528 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/tune_session.py:545 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
strata_control/updater.py:321 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/ab_engine.py:125 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/ab_engine.py:63 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/ab_engine.py:84 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/agent_turns_bench.py:159 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/agent_turns_bench.py:196 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/canonical_xcheck.py:613 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/check_lookup_window_serve.py:100 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/conversation_cache_http_smoke.py:61 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/dflash2/dflash2_ref.py:187 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/dgx_bench.py:115 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/dgx_bench.py:160 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/dgx_bench.py:200 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
tools/dsv41/mkimg.py:31 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
tools/dsv41/mkprompts.py:24 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/dsv41/vision_pack.py:118 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/feed_model_install_gate.py:404 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/force_check.py:60 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/hip/bench_prefill.py:51 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/mtp_fetch.py:211 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/mtp_fetch.py:230 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/mtp_fetch.py:255 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/nvfp4_local_pack.py:117 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/par_run.py:145 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/par_run.py:161 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/par_run.py:166 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/piped_read_join_bench.py:220 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
tools/qwen35/q36_interleave_probe.py:78 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/qwen35/q36_par_bench.py:21 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/qwen35/q36_par_bench.py:47 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
tools/qwen35/q36_par_bench.py:51 | file object opened without corresponding close | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:112 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:121 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:155 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:164 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:191 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:207 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:76 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/backends.yml:85 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:103 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:125 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:128 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:133 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:163 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:185 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:188 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:193 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:205 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:83 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:86 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check.yml:91 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/docker-images.yml:110 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:52 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker-images.yml:83 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:58 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:61 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:68 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/intake.yml:14 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/intake.yml:22 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/intake.yml:23 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/intake.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/intake.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/intake.yml:49 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/intake.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/metal-build.yml:33 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/reopen.yml:12 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/reopen.yml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/reopen.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/scripts-test.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/scripts-test.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/snapshot.yml:57 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/snapshot.yml:60 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/snapshot.yml:65 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/snapshot.yml:79 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/terminal-minimal-server.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/terminal-minimal-server.yml:40 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/terminal-portable-monitor.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/terminal-portable-monitor.yml:46 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/dockerfile.security.missing-user |
Dockerfile:109 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
Dockerfile:111 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
Dockerfile:112 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/desktop/scripts/app-close-matrix.py:196 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/desktop/scripts/app-close-matrix.py:207 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/desktop/scripts/app-close-matrix.py:256 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/desktop/scripts/app-close-matrix.py:97 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/desktop/scripts/stage-control.py:157 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/desktop/scripts/stage-control.py:167 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/desktop/scripts/stage-control.py:50 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | osv/GHSA-q7v9-x93c-xqv3 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0367 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0367 | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
apps/host/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | opengrep/typescript.react.security.react-insecure-request |
apps/host/scripts/append-localization.mjs:8 | Unencrypted request over HTTP detected. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
apps/host/scripts/assets/make-chat-media.py:32 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/typescript.react.security.react-insecure-request |
apps/host/scripts/pictures-ui.mjs:66 | Unencrypted request over HTTP detected. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
apps/host/scripts/prepare-brand-assets.py:139 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
apps/host/scripts/prepare-brand-assets.py:15 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
apps/host/scripts/prepare-brand-assets.py:59 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true |
apps/host/server/agent/custom-command-run.mjs:86 | Found '$SPAWN' with '{shell: plan.shell}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to... | Static analysis (opengrep) |
| high | gitleaks/curl-auth-header |
apps/host/src/screens/Serving.tsx:78 | Possible curl-auth-header secret in the current tree | Secrets (gitleaks) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/bench_vs_llama.py:97 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-09-27-esp/esp_kl.py:46 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-02-community-rtx2080ti-11gb/run_needles.py:45 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-02-community-rtx2080ti-11gb/run_needles.py:45 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-2x-rtx3060/bench-0.1.39.py:186 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-2x-rtx3060/bench.py:186 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/ab.py:147 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/ab.py:193 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/ab.py:197 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/run_all.py:220 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/run_all.py:61 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/run_all.py:83 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/strata_eval.py:115 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/strata_eval2.py:133 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx-6800-windows/strata_eval2.py:276 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-04-community-rx7900xtx-hipblaslt-100500/ab-driver.py:141 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-05-community-2x-p40/scripts/bench.py:254 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-05-community-arc-b65/build-stride-check.py:10 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-05-community-arc-b65/build-stride-check.py:10 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-05-community-arc-b65/build-stride-check.py:13 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-05-community-arc-b65/build-stride-check.py:13 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-05-community-arc-b65/prepare-mtp.py:18 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-05-community-arc-b65/prepare-mtp.py:18 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-05-community-arc-b65/prepare-mtp.py:20 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-05-community-arc-b65/prepare-mtp.py:20 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-07-community-arc-b65-v01402/prepare-mtp.py:18 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-07-community-arc-b65-v01402/prepare-mtp.py:18 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-07-community-arc-b65-v01402/prepare-mtp.py:20 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-07-community-arc-b65-v01402/prepare-mtp.py:20 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-08-community-r9700-linux/harness/run_pairs.py:126 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-08-community-r9700-linux/harness/run_pairs.py:126 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-audit |
bench/results/2026-10-08-community-r9700-linux/harness/single_gpu.py:138 | Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args |
bench/results/2026-10-08-community-r9700-linux/harness/single_gpu.py:138 | Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-08-community-r9700-linux/harness/single_gpu.py:66 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-08-community-rtx4070-iq2-xs/reproduce.py:195 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-4x-rx-7900-xt/arms2.py:25 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-4x-rx-7900-xt/arms2.py:77 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-gfx1151-ud-iq4xs-0.1.41/scripts/measure.py:83 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
bench/results/2026-10-09-community-gfx1151-ud-iq4xs-0.1.41/scripts/measure.py:83 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-gfx1151-ud-iq4xs-0.1.41/scripts/measure.py:99 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_finish_code.py:107 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_iq3_extra_recall.py:18 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:311 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:429 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:762 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_run.py:883 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-09-community-rtx-3060-0141/scripts/strata_bench_soak_retry.py:21 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-11-community-rtx3090-5600x-arena-async/strata_ab2.py:160 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
bench/results/2026-10-11-community-rtx3090-5600x-arena-pin-by-need/strata_ab2.py:160 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
docker/Dockerfile:128 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
docker/Dockerfile:133 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
docker/Dockerfile:134 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
integrations/harness/_bridge.py:85 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
integrations/harness/_bridge.py:96 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
integrations/harness/bridge_e2e.py:101 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
integrations/harness/bridge_e2e.py:90 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
integrations/harness/revise_once.py:112 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
integrations/harness/revise_once.py:113 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
integrations/harness/tool_flow_e2e.py:419 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
integrations/harness/tool_flow_e2e.py:419 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
integrations/harness/tool_flow_e2e.py:444 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
metal/setup_mac.py:144 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
metal/setup_mac.py:188 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
metal/setup_mac.py:331 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
metal/tools/gen_stubs.py:70 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
metal/tools/gen_stubs.py:81 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
metal/tools/msl_text_check.py:55 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
metal/tools/msl_text_check.py:77 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/lock_wheels.py:102 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/lock_wheels.py:133 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/package_terminal.py:210 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/package_terminal.py:213 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/package_terminal.py:214 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/package_terminal.py:443 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
packaging/package_terminal.py:443 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/smoke_terminal.py:205 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
packaging/smoke_terminal.py:205 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/smoke_terminal.py:93 | Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
packaging/smoke_terminal.py:98 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | osv/GHSA-29pf-2h5f-8g72 |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2026-2289, GHSA-29pf-2h5f-8g72 | Dependencies (osv-scanner) |
| high | osv/GHSA-63cw-57p8-fm3p |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2026-2286, GHSA-63cw-57p8-fm3p | Dependencies (osv-scanner) |
| high | osv/GHSA-69w3-r845-3855 |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2026-2288, GHSA-69w3-r845-3855 | Dependencies (osv-scanner) |
| high | osv/GHSA-x9r9-c232-4q39 |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2026-4174, GHSA-x9r9-c232-4q39 | Dependencies (osv-scanner) |
| high | osv/GHSA-xrqw-3rrv-vx5w |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2026-3929, GHSA-xrqw-3rrv-vx5w | Dependencies (osv-scanner) |
| high | osv/PYSEC-2025-217 |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2025-217 | Dependencies (osv-scanner) |
| high | osv/PYSEC-2026-139 |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by PYSEC-2026-139 | Dependencies (osv-scanner) |
| high | osv/GHSA-22hg-r758-rrw9 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9 | Dependencies (osv-scanner) |
| high | osv/GHSA-27h8-gf7j-v5hc |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc | Dependencies (osv-scanner) |
| high | osv/GHSA-3j72-p6qg-6xp7 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7 | Dependencies (osv-scanner) |
| high | osv/GHSA-4558-3h8r-v8xp |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp | Dependencies (osv-scanner) |
| high | osv/GHSA-4rr5-89j8-mwwm |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4328, GHSA-4rr5-89j8-mwwm | Dependencies (osv-scanner) |
| high | osv/GHSA-58r4-6rv3-gfh8 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5xm2-6676-qcp9 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9 | Dependencies (osv-scanner) |
| high | osv/GHSA-65qm-jvmh-6pqg |
requirements.txt | [email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg | Dependencies (osv-scanner) |
| high | osv/GHSA-78g4-xqwv-q3g8 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-78g4-xqwv-q3g8 | Dependencies (osv-scanner) |
| high | osv/GHSA-7mwm-ghpf-9vrm |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm | Dependencies (osv-scanner) |
| high | osv/GHSA-9v9v-9qvf-h2hj |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj | Dependencies (osv-scanner) |
| high | osv/GHSA-c6hw-5grf-ff96 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96 | Dependencies (osv-scanner) |
| high | osv/GHSA-cp9v-662q-vvx9 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4333, GHSA-cp9v-662q-vvx9 | Dependencies (osv-scanner) |
| high | osv/GHSA-f2g6-542v-9j58 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58 | Dependencies (osv-scanner) |
| high | osv/GHSA-g4qv-2jxx-769h |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4342, GHSA-g4qv-2jxx-769h | Dependencies (osv-scanner) |
| high | osv/GHSA-g7cr-3p24-7wf7 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7 | Dependencies (osv-scanner) |
| high | osv/GHSA-g842-9rc4-69pw |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw | Dependencies (osv-scanner) |
| high | osv/GHSA-gg2r-wvfm-q9rx |
requirements.txt | [email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx | Dependencies (osv-scanner) |
| high | osv/GHSA-j4m9-6w36-pw47 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47 | Dependencies (osv-scanner) |
| high | osv/GHSA-jg86-v3jv-hrpm |
requirements.txt | [email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm | Dependencies (osv-scanner) |
| high | osv/GHSA-mrfp-p49p-3hf2 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2 | Dependencies (osv-scanner) |
| high | osv/GHSA-p4wg-p73j-c528 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528 | Dependencies (osv-scanner) |
| high | osv/GHSA-pchr-8j38-3x4p |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p | Dependencies (osv-scanner) |
| high | osv/GHSA-q45j-58j2-45rg |
requirements.txt | [email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg | Dependencies (osv-scanner) |
| high | osv/GHSA-xcvg-w56q-r89m |
requirements.txt | [email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m | Dependencies (osv-scanner) |
| high | osv/GHSA-xgh8-jp6q-p5x8 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8 | Dependencies (osv-scanner) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/ab-harnesses-2026-10/arc/ab.py:37 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
research/tools/ab-harnesses-2026-10/arc/ab.py:37 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/ab-harnesses-2026-10/arc/b.py:46 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/ab-harnesses-2026-10/idle_gpu_ab.py:236 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_128k.py:44 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_concurrent.py:56 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_kvresident.py:37 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_kvresident2.py:33 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_longctx.py:38 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_needle.py:60 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
research/tools/dgx-spark-2026-10/dgx_needle.py:60 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_quality.py:40 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_quality24.py:74 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_smoke.py:28 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
research/tools/dgx-spark-2026-10/dgx_smoke.py:28 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_turns.py:57 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
research/tools/dgx-spark-2026-10/dgx_turns.py:57 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
research/tools/dgx-spark-2026-10/dgx_warm.py:68 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
research/tools/dgx-spark-2026-10/dgx_warm.py:68 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/lifeline.py:185 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/lifeline.py:292 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/lifeline.py:296 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/server.py:4205 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/server.py:4414 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/server.py:5435 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/telemetry.py:305 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:139 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:139 | User controlled data in a `$("metrics").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:1398 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:1398 | User controlled data in a `c.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:1402 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:1402 | User controlled data in a `x.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:1552 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:1552 | User controlled data in a `$("lang").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:166 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:166 | User controlled data in a `$(`mv-${key}`).innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:25 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:25 | User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:540 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:540 | User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:564 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:564 | User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:630 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:630 | User controlled data in a `$("mcp-list").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:652 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:652 | User controlled data in a `$("cfg-form").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:820 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:820 | User controlled data in a `c.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:831 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:831 | User controlled data in a `c.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:844 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:844 | User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/app.js:961 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/app.js:961 | User controlled data in a `bubble.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
serve/web/chats-ui.js:93 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
serve/web/chats-ui.js:93 | User controlled data in a `row.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/winjob.py:106 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
serve/winjob.py:109 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:10107 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:10576 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:11497 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
setup.py:11497 | Detected subprocess function 'call' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:1159 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:1201 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:2621 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:5004 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:5129 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-audit |
setup.py:8040 | Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-tainted-env-args |
setup.py:8040 | Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:8042 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:8325 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:8528 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:8554 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:8743 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:9469 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
setup.py:9607 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/bench_facts.py:142 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/bench_standard.py:684 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/cli.py:1585 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
strata_cli/cli.py:1585 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/cli.py:2091 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
strata_cli/cli.py:2091 | Detected subprocess function 'call' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/launch/access.py:106 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/launch/access.py:188 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/launch/access.py:402 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/launch/params.py:259 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/launch/params.py:272 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/launch/runner.py:444 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_cli/launch/runner.py:711 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/doctor.py:98 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/dsv41_engine.py:326 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/dsv41_flags.py:41 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/dsv41_paths.py:268 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/engine_component.py:575 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/engine_component.py:768 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/engine_component.py:929 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/engine_component.py:961 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/gpu_roles.py:537 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/profiles.py:365 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
strata_control/profiles.py:365 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/recipes.py:312 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
strata_control/recipes.py:312 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/runtime.py:647 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/runtime.py:985 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/runtime.py:993 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/shape_engine.py:207 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/shape_engine.py:226 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/time_skip.py:163 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
strata_control/time_skip.py:163 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/time_skip.py:165 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
strata_control/time_skip.py:165 | Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/time_skip.py:173 | Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/tune_machine.py:72 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/tuning.py:217 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/updater.py:1441 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/updater.py:233 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
strata_control/updater.py:818 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
sycl/setup_intel.py:186 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
sycl/tools/Dockerfile:9 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/ab_engine.py:100 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/ab_engine.py:100 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/agent_turns_bench.py:173 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/agent_turns_bench.py:173 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/check_cuda_spills.py:319 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/check_cuda_spills.py:360 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/check_lookup_window_serve.py:47 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/collect_profile_traces.py:84 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/collect_profile_traces.py:84 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dgx_bench.py:161 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/engram_iq4nl_bench.py:356 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/engram_iq4nl_bench.py:362 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/ista_intake.py:65 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/mkimg.py:32 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/mkprompts.py:25 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/serve_prompts.py:33 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/smoke.py:89 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/dsv41/smoke.py:89 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/dsv41/tune.py:71 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/feed_model_install_gate.py:176 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/feed_model_install_gate.py:271 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/feed_model_install_gate.py:395 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/force_check.py:61 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/hip/package_windows.py:64 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/iq_pack.py:707 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/iq_pack.py:707 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/minimal_cli_smoke.py:31 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/minimal_server_smoke.py:40 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/nvfp4_local_pack.py:601 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par/both.py:15 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par/both.py:15 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par/e00.py:13 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
tools/par/e00.py:13 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par/e00.py:18 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par/e00.py:18 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par/recon.py:29 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par/recon.py:47 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par/recon3.py:57 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par/recon3.py:57 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par/sweep.py:43 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par/sweep.py:43 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par_run.py:147 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par_run.py:147 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par_run.py:171 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par_run.py:171 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par_run.py:185 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par_run.py:185 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/par_run.py:192 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/par_run.py:192 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
tools/par_run.py:192 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/portable_monitor_pty_smoke.py:40 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/portable_monitor_smoke.py:140 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/portable_monitor_smoke.py:155 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/portable_monitor_smoke.py:90 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/quant_quality.py:147 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/quant_quality.py:226 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/qwen35/kl.py:30 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/qwen35/parity.py:30 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/qwen35/q36_harness.py:22 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/qwen35/q36_par_bench.py:52 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/qwen35/q36_venc.py:5 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/qwen35/q36_venc.py:5 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/qwen35/q36_vision_cmp.py:35 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/qwen35/q36_vram_refusal.py:24 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_bench.py:444 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_bench.py:795 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_mcp.py:2951 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_mcp.py:2956 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_mcp.py:2974 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_mcp.py:373 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_mcp.py:375 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_mcp.py:376 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/strata_mcp.py:382 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/trellis/run_parts.py:65 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/trellis/run_parts.py:65 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/trellis/sanity_greedy.py:43 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
tools/trellis/sanity_greedy.py:43 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
.github/scripts/item-check.js:130 | Detected the use of a regular expression `\bv?\d+\.\d+(\.\d+)*(-[a-z0-9.]+)?\b|\b[0-9a-f]{7,40}\b|\bcommit\b` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review... | Static analysis (opengrep) |
| medium | zizmor/template-injection |
.github/workflows/docker-images.yml:109 | code injection via template expansion [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/template-injection |
.github/workflows/docker-images.yml:111 | code injection via template expansion [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/docker-images.yml:52 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/docker-images.yml:83 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/metal-build.yml:33 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/scripts-test.yml:17 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
apps/desktop/scripts/app-close-matrix.py:119 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
apps/desktop/scripts/app-close-matrix.py:133 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/desktop/scripts/installer-mockups.mjs:28 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/desktop/scripts/installer-mockups.mjs:32 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/desktop/scripts/installer-mockups.mjs:37 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/desktop/scripts/installer-mockups.mjs:42 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
apps/desktop/scripts/installer-mockups.mjs:47 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | osv/GHSA-8hxf-qr8p-62x4 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by GHSA-8hxf-qr8p-62x4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-wrw7-89jp-8q8g |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0429, GHSA-wrw7-89jp-8q8g | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0370 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0370 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0368 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0368 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0370 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0370 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0371 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0371 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0372 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0372 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0382 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0382 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0383 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0383 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0486 |
apps/desktop/src-tauri/Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0486 | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
apps/host/package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
apps/host/package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
apps/host/package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-qfhq-4f3w-5fph |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by GHSA-qfhq-4f3w-5fph | Dependencies (osv-scanner) |
| medium | osv/GHSA-rrmf-rvhw-rf47 |
requirements-nvfp4-local.txt | [email protected] (PyPI) is affected by GHSA-rrmf-rvhw-rf47 | Dependencies (osv-scanner) |
| medium | osv/GHSA-24rc-8hj2-v98c |
requirements.txt | [email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c | Dependencies (osv-scanner) |
| medium | osv/GHSA-254f-3936-288h |
requirements.txt | [email protected] (PyPI) is affected by GHSA-254f-3936-288h | Dependencies (osv-scanner) |
| medium | osv/GHSA-462x-pgg6-55fp |
requirements.txt | [email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp | Dependencies (osv-scanner) |
| medium | osv/GHSA-4rm8-3hmm-39fg |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg | Dependencies (osv-scanner) |
| medium | osv/GHSA-654x-cwwv-5j9c |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4336, GHSA-654x-cwwv-5j9c | Dependencies (osv-scanner) |
| medium | osv/GHSA-74r2-7ff9-mjj2 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc9g-5qg7-mf45 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45 | Dependencies (osv-scanner) |
| medium | osv/GHSA-p8hx-v2p6-rp84 |
requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rfgq-q3w2-pmv2 |
requirements.txt | [email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vx6w-vv9f-6gvg |
requirements.txt | [email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wqgw-9xfh-qf2g |
requirements.txt | [email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g | Dependencies (osv-scanner) |
| low | osv/GHSA-9jrq-w75r-8gcw |
apps/host/package-lock.json | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
apps/host/scripts/approval-flow.mjs:35 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
apps/host/scripts/ui-do-drive.mjs:41 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
apps/host/tests/agent-bridge.test.mjs:200 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
apps/host/tests/agent-events.test.mjs:67 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
apps/host/tests/agent-tools-settings.test.mjs:56 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
apps/host/tests/agent-tools.test.mjs:230 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
apps/host/tests/serving-key-compare.test.mjs:20 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/prompts/standard-v1/build.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-03-community-z840-rtx3090ti/strata-numa-ab.sh:20 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-04-community-rtx4090-iq3xxs-200k-code/config.json:79 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-04-community-rtx4090-iq3xxs-200k-code/env.json:156 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-04-community-rtx4090-iq3xxs-200k-code/runs.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-04-community-rtx4090-iq3xxs-200k-ru/config.json:79 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-04-community-rtx4090-iq3xxs-200k-ru/env.json:156 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-04-community-rtx4090-iq3xxs-200k-ru/runs.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-04-rdna2-fp16-prompt/README.md:61 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-06-q8-prefill8192-rtxpro/measurements.json:1 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-07-community-arc-b65-v01402/measured-driver-sha256.json:5 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-07-community-xtx-6800xt-1m-helper/provenance.json:4 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-code/env.json:156 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-code/runs-0.1.40-baseline.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-code/runs-0.1.40.2-previous.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-code/runs.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-ru/env.json:156 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-ru/runs-0.1.40-baseline.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-ru/runs-0.1.40.2-previous.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-08-community-rtx4090-iq3xxs-200k-ru/runs.json:159 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-09-community-rtx-3060-0141/model-manifest.json:19 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-09-community-rtx5090-9800x3d-swift-1m/data/confirmation-manifest.json:102 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-09-community-rtx5090-9800x3d-swift-1m/data/decode-manifest.json:203 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-09-community-rtx5090-9800x3d-swift-1m/data/learned-profile-provenance.json:79 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-09-community-rtx5090-9800x3d-swift-1m/data/overlap-prototype-manifest.json:117 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-09-community-rtx5090-9800x3d-swift-1m/data/screen-manifest.json:122 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-09-community-rtx5090-9800x3d-swift-1m/provenance.json:492 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-20-0.2.1-bench/p2003-rtx3060/run1-release-archive-as-shipped/provenance/corpus-build.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-20-0.2.1-bench/p2003-rtx3060/run2-with-commit-and-optional-concurrency/provenance/corpus-build.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-20-0.2.1-bench/p2003-rtx3060/run3-with-fixes/provenance/corpus-build.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-20-0.2.1-bench/z440-2xa4000/run1-release-archive-as-shipped/provenance/corpus-build.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-20-0.2.1-bench/z440-2xa4000/run2-with-commit-and-optional-concurrency/provenance/corpus-build.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/2026-10-20-0.2.1-bench/z440-2xa4000/run3-with-fixes/provenance/corpus-build.json:8 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
bench/results/exchange-rotation-ab.json:68 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
src/core/native_dense.cpp:260 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
src/split/tools/rope_test.cpp:118 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
strata_control/vram_fit.py:94 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
sycl/src/core/native_dense.cpp:206 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/core/gguf_split_test.cpp:98 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/core/native_dense_ple_key_test.cpp:50 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/terminal/test_bench_redaction_0213_qatui.py:22 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/terminal/test_launch.py:1193 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tools/qwen4_intake.py:523 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tools/test_docker_entrypoint.py:86 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tools/test_iq_pack.py:145 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tools/test_strata_bench.py:171 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 53 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 72 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 300 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 54 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 13eedf552417 | prov-5+qual-2+sec-2 | 0% | 54 | 30 |
Full text report
- Repository: https://github.com/Niko1221/Strata
- Commit:
13eedf552417a6a791a7d13c6597e24300ee3a09 - Generated: 2026-11-14T16:59:29+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 95% | 100% |
| Code quality | 54 | weak | 90% | 100% |
| Security | 30 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.1%
- Unattributed share in AI-consistent velocity bursts: 46.8%
- Estimated AI-generated share: 0.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 4 | 352 |
| GitHub Copilot coding agent | 3 | 7 |
| Gemini CLI / Code Assist | 1 | 42 |
| Cursor agent | 1 | 32 |
- AI tooling configured in repo: generic-agent
Current source lines last changed by AI-attributed commits: 174 of 399,999 (sampled).
Too few lines in one group to compare finding densities.
- Stylometry index: 0.03 per 1,000 lines (narrated steps 10, placeholders 0, assistant phrasing 1, emoji 5). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-09 | 178,081 | 0% |
| 2026-10 | 511,368 | 0% |
| 2026-11 | 129,691 | 0% |
Evidence
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (86b283e1eb14)
- Cursor agent: trailer 'Co-authored-by: Cursor' (affb999c6399)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (12d6af092b4d)
- OpenAI Codex: trailer 'Co-Authored-By: Codex' (9c139846d598)
- OpenAI Codex: trailer 'Co-Authored-By: Codex' (94329dd8014c)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (cfe6021eb277)
- Gemini CLI / Code Assist: trailer 'Co-authored-by: Gemini' (392e32c46b41)
- OpenAI Codex: trailer 'Co-authored-by: Codex' (ba1c8099482c)
- OpenAI Codex: trailer 'Co-authored-by: Codex' (08f8d591dabd)
- 6,689 lines of first-party code in ~1.7h (3,972 lines/hour, 2 commit session) (0645f2edecf0)
- 13,948 lines of first-party code in ~3.9h (3,578 lines/hour, 41 commit session) (b73ea23b68a9)
- 6,742 lines of first-party code in ~1.9h (3,520 lines/hour, 5 commit session) (c47df69e0119)
- 3,956 lines of first-party code in ~1.2h (3,400 lines/hour, 1 commit session) (b88eff688b53)
- 8,567 lines of first-party code in ~2.8h (3,103 lines/hour, 52 commit session) (daf4ac087a2d)
- 4,253 lines of first-party code in ~1.5h (2,842 lines/hour, 10 commit session) (8221fb8c1c9a)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.32, CI runs tests; 47% of function code in complex or long functions; 17% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 24 |
| Duplication | 36 |
| Code smells (Opengrep) | 54 |
| Tests and CI | 81 |
| Documentation | 80 |
| Type safety | 47 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 27,295; mean complexity 5.6, 90th percentile 12; 1915 complex and 387 long functions
- Duplicated lines: 17.2% of 438,250 compared
- Tests: 169,138 test lines for 532,323 source lines (ratio 0.32); CI test commands: pytest, unittest; 61% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- main in sycl/src/program/generate.cpp: complexity 3827, 9878 lines
- strata::prefill::Prefill::run_impl in src/prefill/prefill.cpp: complexity 1236, 2824 lines
- api in apps/host/server/index.mjs: complexity 767, 965 lines
- strata::prefill::Prefill::run_impl in sycl/src/prefill/prefill.cpp: complexity 761, 2126 lines
- main in setup.py: complexity 617, 1021 lines
Security
Security posture is poor: 1 possible secret(s) in the tree, 0 only in history; 72 known vulnerabilities in 13 dependencies; 292 high-severity SAST findings; 47 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 11 |
| Static analysis (Opengrep) | 78 |
| Vulnerable dependencies (OSV) | 24 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 72 in 13 packages (critical 9, high 36, medium 17, low 1)
-
Posture checks passed: security policy; missing: dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/RUSTSEC-2026-0369: [email protected] (crates.io) is affected by RUSTSEC-2026-0369 |
apps/desktop/src-tauri/Cargo.lock |
| critical | osv/GHSA-m665-v7pm-7grj: [email protected] (crates.io) is affected by GHSA-m665-v7pm-7grj |
apps/desktop/src-tauri/Cargo.lock |
| critical | osv/GHSA-fgcw-684q-jj6r: [email protected] (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r |
requirements-nvfp4-local.txt |
| critical | osv/GHSA-5x8w-8jj5-q52h: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
requirements.txt |
| critical | osv/GHSA-8g5g-8vmr-9782: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
requirements.txt |
| critical | osv/GHSA-v9pv-5gc8-w2m6: [email protected] (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 |
requirements.txt |
| critical | osv/GHSA-xvh5-g6gv-559v: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
requirements.txt |
| critical | osv/GHSA-332p-7hrc-92wf: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf |
requirements.txt |
| critical | osv/GHSA-w889-685w-c8fh: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh |
requirements.txt |
| high | gitleaks/curl-auth-header: Possible curl-auth-header secret in the current tree |
apps/host/src/screens/Serving.tsx:78 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:109 |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:111 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:112 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/desktop/scripts/app-close-matrix.py:97 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/desktop/scripts/app-close-matrix.py:196 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/desktop/scripts/app-close-matrix.py:207 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/desktop/scripts/app-close-matrix.py:256 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/desktop/scripts/stage-control.py:50 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/desktop/scripts/stage-control.py:157 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/desktop/scripts/stage-control.py:167 |
| high | opengrep/typescript.react.security.react-insecure-request: Unencrypted request over HTTP detected. [confidence medium] |
apps/host/scripts/append-localization.mjs:8 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
apps/host/scripts/assets/make-chat-media.py:32 |
| high | opengrep/typescript.react.security.react-insecure-request: Unencrypted request over HTTP detected. [confidence medium] |
apps/host/scripts/pictures-ui.mjs:66 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
apps/host/scripts/prepare-brand-assets.py:15 |
| high | opengrep/python.lang.security.use-defused-xml-parse: The native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using defusedxml. [confidence medium] |
apps/host/scripts/prepare-brand-assets.py:59 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.2.13 ships install.ps1 (11998 downloads)
- binary-release-asset: release v0.2.13 ships Strata-0.2.13-linux-x86_64.AppImage (4874 downloads)
- binary-release-asset: release v0.2.13 ships Strata-0.2.13-macos-arm64.dmg (2576 downloads)
- binary-release-asset: release v0.2.13 ships Strata-0.2.13-windows-x64-setup.exe (33335 downloads)
- binary-release-asset: release v0.2.13 ships strata-control-0.1.59-linux-aarch64.tar.gz (850 downloads)
- star-burst: 44104 stars in 51 days (865/day)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 532,323; test lines: 169,138
| Language | Lines |
|---|---|
| C++ | 326,046 |
| Python | 273,244 |
| JavaScript | 61,649 |
| TypeScript | 22,269 |
| C | 9,106 |
| Shell | 4,766 |
| Rust | 3,860 |
| PowerShell | 521 |