Leaderboard github.com

chivta/url-lengthener

Over-engineered URL lengthener with domain too long for Website field, so here it is: https://yet-another-overengineered-url-shortener-learning.project-except-its-actually-lengthening-urls-this-time-so-the.domain-has-to-be-255-symbols-in-total-and.reach-rfc2181-domain-name-length-limit.confusing-anyone-who-encounters-this-saas-online.chivtar.dev

View repository ↗
Go
★ 0
commit 53a7bf40c2a2
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 51%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

85/100

strong

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

37/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files4
Work sessions at AI pace0
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

2026-062,777 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 43
effective_loc: 2,777
tools_detected: 0

AI tool configurationok4 items

artifacts: 4
earliest_adoption: 2026-06-05
tools_configured: 1
workflow_agents: 0

Commit velocityok

excluded_import_loc: 2,232
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 47.50
measured_loc: 545
median_loc_per_hour: 47.50
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 9

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 1,762
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

85 strong

Code quality is strong: test-to-source ratio 0.31, CI runs tests; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: docs.

How the score is built

Complexity100
Duplication100
Lint and smells65
Tests and CI90
Documentation40
Type safety100
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok

complex_functions: 0
function_nloc: 658
functions: 72
long_functions: 0
many_param_functions: 0
mean_ccn: 2.38
p90_ccn: 5
risky_nloc_share: 0.0%

Duplication (jscpd)ok

compared_lines: 1,134
duplicated_lines: 0
duplicated_share: 0.0%
files: 71

Lintok

category:best-practice: 3
findings: 3
scanned_lines: 1,722
weighted_findings: 3

Tests and CIok5 items

CI config: .github/workflows/cd.yaml .github/workflows/cd.yaml
CI config: .github/workflows/ci.yaml .github/workflows/ci.yaml
CI config: .github/workflows/infra.yaml .github/workflows/infra.yaml
CI runs tests (npm test, go test)
CI runs linters (eslint, golangci-lint)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 3
cochange_commits: 16
cochange_share: 25.0%
source_lines: 1,762
test_lines: 545
test_ratio: 0.31

Documentationok1 item

README.md README.md

check:changelog: no
check:contributing: no
check:license: no
check:readme: yes
readme_lines: 54

Type safetyok1 item

TypeScript strict type checking: frontend/tsconfig.json frontend/tsconfig.json

check:low_escape_density: yes
check:strict_config: yes
escapes: 0
escapes_per_kloc: 0

Security

37 poor

Security posture is poor: 138 known vulnerabilities in 32 dependencies; 2 high-severity SAST findings; 22 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)39
Vulnerable dependencies2
CI workflows1
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 22
declared: 22
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 7
findings_high: 2
findings_low: 3
findings_medium: 2
parse_errors: 0
scanned_lines: 1,722
weighted_findings: 4.64

Dependencies (osv-scanner)ok

penalty: 222
vulnerabilities: 138
vulnerable_packages: 32
vulns_critical: 10
vulns_high: 47
vulns_low: 14
vulns_medium: 46
vulns_unknown: 21

CI workflows (zizmor)ok

findings: 36
findings_high: 22
findings_low: 5
findings_medium: 9
penalty: 273.30
workflows: 3

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.0%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

10 critical71 high81 medium20 low2 info

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-5cgq-3rg8-m6cv`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv	Dependencies (osv-scanner)
critical	`osv/GHSA-89gr-r52h-f8rx`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx	Dependencies (osv-scanner)
critical	`osv/GHSA-f5wc-c3c7-36mc`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc	Dependencies (osv-scanner)
critical	`osv/GHSA-jppx-rxg9-jmrx`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx	Dependencies (osv-scanner)
critical	`osv/GHSA-rm3j-f69w-wqmq`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq	Dependencies (osv-scanner)
critical	`osv/GHSA-vgwf-h737-ff37`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37	Dependencies (osv-scanner)
critical	`osv/GHSA-x527-x647-q7gg`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg	Dependencies (osv-scanner)
critical	`osv/GHSA-5gmw-xhrv-c9v3`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
critical	`osv/GHSA-5xrq-8626-4rwp`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-5xrq-8626-4rwp; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
critical	`osv/GHSA-85c8-ppgw-ccpr`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
high	`zizmor/unpinned-uses`	.github/workflows/cd.yaml:18	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/dangerous-triggers`	.github/workflows/cd.yaml:4	use of fundamentally insecure workflow trigger [confidence medium]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/cd.yaml:60	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/cd.yaml:65	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/cd.yaml:72	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/cd.yaml:75	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/cd.yaml:80	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/cd.yaml:85	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/cd.yaml:96	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:27	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:28	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:39	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:47	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:48	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:66	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:67	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:72	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yaml:76	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/infra.yaml:21	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/infra.yaml:26	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/infra.yaml:32	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/dangerous-triggers`	.github/workflows/infra.yaml:4	use of fundamentally insecure workflow trigger [confidence medium]	CI workflows (zizmor)
high	`opengrep/dockerfile.security.missing-user`	api/Dockerfile:4	By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile...	Static analysis (opengrep)
high	`osv/GHSA-q4h4-gmj2-qvw2`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2	Dependencies (osv-scanner)
high	`osv/GHSA-w879-237q-wc7r`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r	Dependencies (osv-scanner)
high	`opengrep/dockerfile.security.missing-user`	frontend/Dockerfile:6	By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile...	Static analysis (opengrep)
high	`osv/GHSA-2883-xcg3-v3hh`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-2883-xcg3-v3hh	Dependencies (osv-scanner)
high	`osv/GHSA-28wg-ghj8-5hjv`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
high	`osv/GHSA-2v37-7h3g-55p8`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-2v37-7h3g-55p8; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
high	`osv/GHSA-3jxr-9vmj-r5cp`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp	Dependencies (osv-scanner)
high	`osv/GHSA-3jxr-9vmj-r5cp`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp	Dependencies (osv-scanner)
high	`osv/GHSA-52cp-r559-cp3m`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-52cp-r559-cp3m	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
high	`osv/GHSA-5p4m-2wfm-xmqj`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-73wf-gq98-2v4g`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-73wf-gq98-2v4g	Dependencies (osv-scanner)
high	`osv/GHSA-c83g-rgw3-j3cx`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx	Dependencies (osv-scanner)
high	`osv/GHSA-hmw2-7cc7-3qxx`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx	Dependencies (osv-scanner)
high	`osv/GHSA-mh99-v99m-4gvg`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	Dependencies (osv-scanner)
high	`osv/GHSA-mh99-v99m-4gvg`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
high	`osv/GHSA-r28c-9q8g-f849`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-r28c-9q8g-f849; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
high	`osv/GHSA-rgw5-rvv9-x895`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	Dependencies (osv-scanner)
high	`osv/GHSA-rgw5-rvv9-x895`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	Dependencies (osv-scanner)
high	`osv/GHSA-2m5v-pch6-74hx`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-2m5v-pch6-74hx	Dependencies (osv-scanner)
high	`osv/GHSA-36p8-mvp6-cv38`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-36p8-mvp6-cv38	Dependencies (osv-scanner)
high	`osv/GHSA-5x38-2vff-x55p`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-5x38-2vff-x55p	Dependencies (osv-scanner)
high	`osv/GHSA-6qrw-m8cv-hcxf`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-6qrw-m8cv-hcxf	Dependencies (osv-scanner)
high	`osv/GHSA-7wch-p9px-956x`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-7wch-p9px-956x	Dependencies (osv-scanner)
high	`osv/GHSA-86w9-cpqp-85rv`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-86w9-cpqp-85rv	Dependencies (osv-scanner)
high	`osv/GHSA-8hrf-8g6f-7xwp`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-8hrf-8g6f-7xwp	Dependencies (osv-scanner)
high	`osv/GHSA-96hv-2xvq-fx4p`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p	Dependencies (osv-scanner)
high	`osv/GHSA-f88m-g3jw-g9cj`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-f88m-g3jw-g9cj	Dependencies (osv-scanner)
high	`osv/GHSA-hqq3-7jhf-c5jx`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-hqq3-7jhf-c5jx	Dependencies (osv-scanner)
high	`osv/GHSA-jc66-7q78-782g`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-jc66-7q78-782g	Dependencies (osv-scanner)
high	`osv/GHSA-mcm9-63f2-9j32`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-mcm9-63f2-9j32	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	Dependencies (osv-scanner)
high	`osv/GHSA-qrxm-fqhp-jwvm`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm	Dependencies (osv-scanner)
high	`osv/GHSA-r9w8-h9r3-54w4`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-r9w8-h9r3-54w4	Dependencies (osv-scanner)
high	`osv/GHSA-rgj7-g3m4-5g8c`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-rgj7-g3m4-5g8c	Dependencies (osv-scanner)
high	`osv/GHSA-rhr8-3pm8-cq29`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-rhr8-3pm8-cq29	Dependencies (osv-scanner)
high	`osv/GHSA-v9p9-hfj2-hcw8`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-v9p9-hfj2-hcw8	Dependencies (osv-scanner)
high	`osv/GHSA-vj54-72f3-p5jv`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-vj54-72f3-p5jv	Dependencies (osv-scanner)
high	`osv/GHSA-vrm6-8vpv-qv8q`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-vrm6-8vpv-qv8q	Dependencies (osv-scanner)
high	`osv/GHSA-vxpw-j846-p89q`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-vxpw-j846-p89q	Dependencies (osv-scanner)
high	`osv/GHSA-wq5f-xc86-pv6w`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-wq5f-xc86-pv6w	Dependencies (osv-scanner)
high	`osv/GHSA-x8mw-p69m-v3mx`	worker/worker/package-lock.json	@fastify/[email protected] (npm) is affected by GHSA-x8mw-p69m-v3mx	Dependencies (osv-scanner)
medium	`opengrep/terraform.aws.best-practice.aws-rds-iam-authentication-not-enabled`	infra/modules/rds/main.tf:23	The AWS RDS is not configured to use IAM authentication. Consider using IAM for authentication.	Lint
medium	`opengrep/terraform.aws.best-practice.aws-rds-multiaz-not-enabled`	infra/modules/rds/main.tf:23	The AWS RDS is not configured to use multi-az. Consider using it if possible.	Lint
medium	`opengrep/terraform.aws.best-practice.aws-s3-bucket-versioning-not-enabled`	infra/modules/s3/main.tf:1	Ensure that Amazon S3 bucket versioning is not enabled. Consider using versioning if you don't have alternative backup mechanism.	Lint
medium	`zizmor/excessive-permissions`	.github/workflows/cd.yaml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/cd.yaml:10	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yaml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yaml:10	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yaml:27	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yaml:44	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yaml:47	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yaml:63	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yaml:66	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`osv/GHSA-45gg-vh54-h5m9`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9	Dependencies (osv-scanner)
medium	`osv/GHSA-5cv4-jp36-h3mw`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5028, GHSA-5cv4-jp36-h3mw	Dependencies (osv-scanner)
medium	`osv/GHSA-78mq-xcr3-xm33`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33	Dependencies (osv-scanner)
medium	`osv/GHSA-9m57-25v3-79x9`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9	Dependencies (osv-scanner)
medium	`osv/GHSA-qpw4-5x99-6vjp`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp	Dependencies (osv-scanner)
medium	`osv/GHSA-vvgj-x9jq-8cj9`	api/go.mod	github.com/quic-go/[email protected] (Go) is affected by GO-2026-5676, GHSA-vvgj-x9jq-8cj9	Dependencies (osv-scanner)
medium	`osv/GO-2026-4918`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-4918	Dependencies (osv-scanner)
medium	`osv/GO-2026-5024`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5024	Dependencies (osv-scanner)
medium	`osv/GO-2026-5025`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5025	Dependencies (osv-scanner)
medium	`osv/GO-2026-5026`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5026	Dependencies (osv-scanner)
medium	`osv/GO-2026-5027`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5027	Dependencies (osv-scanner)
medium	`osv/GO-2026-5029`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5029	Dependencies (osv-scanner)
medium	`osv/GO-2026-5030`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5030	Dependencies (osv-scanner)
medium	`osv/GO-2026-5932`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5932	Dependencies (osv-scanner)
medium	`osv/GO-2026-5942`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5942	Dependencies (osv-scanner)
medium	`osv/GO-2026-5970`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5970	Dependencies (osv-scanner)
medium	`osv/GO-2026-6303`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6303	Dependencies (osv-scanner)
medium	`osv/GO-2026-6354`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6354	Dependencies (osv-scanner)
medium	`osv/GO-2026-6355`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6355	Dependencies (osv-scanner)
medium	`osv/GO-2026-6603`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6603	Dependencies (osv-scanner)
medium	`osv/GO-2026-6610`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6610	Dependencies (osv-scanner)
medium	`osv/GO-2026-6611`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6611	Dependencies (osv-scanner)
medium	`osv/GO-2026-6612`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6612	Dependencies (osv-scanner)
medium	`osv/GO-2026-6617`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6617	Dependencies (osv-scanner)
medium	`osv/GO-2026-6629`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6629	Dependencies (osv-scanner)
medium	`osv/GO-2026-6860`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6860	Dependencies (osv-scanner)
medium	`osv/GO-2026-6866`	api/go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6866	Dependencies (osv-scanner)
medium	`opengrep/dockerfile.security.secret-in-build-arg`	frontend/Dockerfile:10	Docker build time arguments are not suited for secrets, because the argument values are saved with the image. Running `docker image history` on the image will show information on how the image was built, including arguments. If these...	Static analysis (opengrep)
medium	`osv/GHSA-337j-9hxr-rhxg`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-337j-9hxr-rhxg	Dependencies (osv-scanner)
medium	`osv/GHSA-4w7w-66w2-5vf9`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-67mh-4wv8-2f99`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-67mh-4wv8-2f99; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	frontend/package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-fx2h-pf6j-xcff`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-fxqj-rqcc-2cmp`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`osv/GHSA-jjmj-jmhj-qwj2`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-jjmj-jmhj-qwj2	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-qxg6-89mg-rqv8`	frontend/package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-v6wh-96g9-6wx3`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
medium	`osv/GHSA-w5vr-8v7q-w6rv`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv	Dependencies (osv-scanner)
medium	`osv/GHSA-wrjc-x8rr-h8h6`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-wrjc-x8rr-h8h6	Dependencies (osv-scanner)
medium	`opengrep/terraform.aws.security.aws-db-instance-no-logging`	infra/modules/rds/main.tf:23	Database instance has no logging. Missing logs can cause missing important event information. [confidence medium]	Static analysis (opengrep)
medium	`osv/GHSA-2mjp-6q6p-2qxm`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-2mjp-6q6p-2qxm	Dependencies (osv-scanner)
medium	`osv/GHSA-4992-7rv2-5pvq`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-4992-7rv2-5pvq	Dependencies (osv-scanner)
medium	`osv/GHSA-4q55-j62x-fr9h`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-4q55-j62x-fr9h	Dependencies (osv-scanner)
medium	`osv/GHSA-525v-9gp9-w22h`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-525v-9gp9-w22h	Dependencies (osv-scanner)
medium	`osv/GHSA-58qx-3vcg-4xpx`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-58qx-3vcg-4xpx	Dependencies (osv-scanner)
medium	`osv/GHSA-5cwg-6vw7-rj6p`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-5cwg-6vw7-rj6p	Dependencies (osv-scanner)
medium	`osv/GHSA-67mh-4wv8-2f99`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-67mh-4wv8-2f99	Dependencies (osv-scanner)
medium	`osv/GHSA-6cv4-p8m7-4r25`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-6cv4-p8m7-4r25	Dependencies (osv-scanner)
medium	`osv/GHSA-6wvx-3r32-xmcg`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-6wvx-3r32-xmcg	Dependencies (osv-scanner)
medium	`osv/GHSA-8xcm-r25x-g524`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-8xcm-r25x-g524	Dependencies (osv-scanner)
medium	`osv/GHSA-9fm3-97px-rjf6`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-9fm3-97px-rjf6	Dependencies (osv-scanner)
medium	`osv/GHSA-9rgm-9g3h-6x36`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-9rgm-9g3h-6x36	Dependencies (osv-scanner)
medium	`osv/GHSA-cfw5-2vxh-hr84`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-cfw5-2vxh-hr84	Dependencies (osv-scanner)
medium	`osv/GHSA-g9mf-h72j-4rw9`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-g9mf-h72j-4rw9	Dependencies (osv-scanner)
medium	`osv/GHSA-gxm5-99cw-xjw9`	worker/worker/package-lock.json	@fastify/[email protected] (npm) is affected by GHSA-gxm5-99cw-xjw9	Dependencies (osv-scanner)
medium	`osv/GHSA-h46v-rmh6-fq4f`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-h46v-rmh6-fq4f	Dependencies (osv-scanner)
medium	`osv/GHSA-hx4r-w6wj-j8fg`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-hx4r-w6wj-j8fg	Dependencies (osv-scanner)
medium	`osv/GHSA-j8rw-jp99-435v`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-j8rw-jp99-435v	Dependencies (osv-scanner)
medium	`osv/GHSA-m8rv-5g2x-5cg5`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5	Dependencies (osv-scanner)
medium	`osv/GHSA-p88m-4jfj-68fv`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-p88m-4jfj-68fv	Dependencies (osv-scanner)
medium	`osv/GHSA-v3r7-h72x-cjcm`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm	Dependencies (osv-scanner)
medium	`osv/GHSA-w4xr-hqv8-ch44`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-w4xr-hqv8-ch44	Dependencies (osv-scanner)
low	`zizmor/artipacked`	.github/workflows/cd.yaml:18	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/cd.yaml:60	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/infra.yaml:21	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`osv/GHSA-9jrq-w75r-8gcw`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw; also in worker/worker/package-lock.json	Dependencies (osv-scanner)
low	`opengrep/javascript.browser.security.js-open-redirect-from-function`	frontend/src/pages/RedirectPage.tsx:13	The application accepts potentially user-controlled input `u` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs....	Static analysis (opengrep)
low	`opengrep/terraform.aws.security.aws-ec2-security-group-rule-missing-description`	infra/modules/elasticache/main.tf:11	The AWS security group rule is missing a description, or its description is empty or the default value. Security groups rules should include a meaningful description in order to simplify auditing, debugging, and managing security...	Static analysis (opengrep)
low	`opengrep/terraform.aws.security.aws-ec2-security-group-rule-missing-description`	infra/modules/rds/main.tf:6	The AWS security group rule is missing a description, or its description is empty or the default value. Security groups rules should include a meaningful description in order to simplify auditing, debugging, and managing security...	Static analysis (opengrep)
low	`osv/GHSA-2vgq-wchc-25w7`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-2vgq-wchc-25w7	Dependencies (osv-scanner)
low	`osv/GHSA-33hq-fvwr-56pm`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-33hq-fvwr-56pm	Dependencies (osv-scanner)
low	`osv/GHSA-35p6-xmwp-9g52`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-35p6-xmwp-9g52	Dependencies (osv-scanner)
low	`osv/GHSA-4487-j8r4-4g2f`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-4487-j8r4-4g2f	Dependencies (osv-scanner)
low	`osv/GHSA-4642-5mcj-2rqw`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-4642-5mcj-2rqw	Dependencies (osv-scanner)
low	`osv/GHSA-6889-vf6x-f3g5`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-6889-vf6x-f3g5	Dependencies (osv-scanner)
low	`osv/GHSA-8qm3-746x-r74r`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-8qm3-746x-r74r	Dependencies (osv-scanner)
low	`osv/GHSA-9wg5-mj3p-v49q`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-9wg5-mj3p-v49q	Dependencies (osv-scanner)
low	`osv/GHSA-g8m3-5g58-fq7m`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-g8m3-5g58-fq7m	Dependencies (osv-scanner)
low	`osv/GHSA-h6cr-wjv9-3cpp`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-h6cr-wjv9-3cpp	Dependencies (osv-scanner)
low	`osv/GHSA-mwv9-gp5h-frr4`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-mwv9-gp5h-frr4	Dependencies (osv-scanner)
low	`osv/GHSA-r53p-7pc4-xj5r`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r	Dependencies (osv-scanner)
low	`osv/GHSA-wf3x-273g-mvxv`	worker/worker/package-lock.json	[email protected] (npm) is affected by GHSA-wf3x-273g-mvxv	Dependencies (osv-scanner)
info	`zizmor/template-injection`	.github/workflows/cd.yaml:45	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/cd.yaml:46	code injection via template expansion [confidence low]	CI workflows (zizmor)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	3
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	36
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	138
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	7
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`53a7bf40c2a2`	`prov-5+qual-2+sec-2`	0%	85	37
2026-11-14	`53a7bf40c2a2`	`prov-4+qual-2+sec-2`	0%	85	37

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/chivta/url-lengthener/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/chivta/url-lengthener/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/chivta/url-lengthener/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/chivta/url-lengthener/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/chivta/url-lengthener/security.svg)](https://repotrust.synapticcyber.com/r/github.com/chivta/url-lengthener/)

Full text report

Repository: https://github.com/chivta/url-lengthener
Commit: 53a7bf40c2a20e5ef56eaa23e102bbe5932d8d89
Generated: 2026-11-14T14:52:03+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	51%	100%
Code quality	85	strong	90%	100%
Security	37	poor	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
AI tooling configured in repo: claude-code

Month	Lines added	Attributed to AI
2026-06	2,777	0%

Evidence

.claude/commands/run.md (claude-code configuration) (.claude/comm)
.claude/commands/verify.md (claude-code configuration) (.claude/comm)
.claude/settings.json (claude-code configuration) (.claude/sett)
CLAUDE.md (claude-code configuration) (CLAUDE.md)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 0.31, CI runs tests; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: docs.

Area	Score
Complexity (lizard)	100
Duplication	100
Code smells (Opengrep)	65
Tests and CI	90
Documentation	40
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 72; mean complexity 2.4, 90th percentile 5; 0 complex and 0 long functions
Duplicated lines: 0.0% of 1,134 compared
Tests: 545 test lines for 1,762 source lines (ratio 0.31); CI test commands: npm test, go test; 25% of recent source commits also change tests
Docs missing or thin: license, contributing, changelog

Security

Security posture is poor: 138 known vulnerabilities in 32 dependencies; 2 high-severity SAST findings; 22 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	39
Vulnerable dependencies (OSV)	2
CI workflows (zizmor)	1
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 138 in 32 packages (critical 10, high 47, medium 46, low 14)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-jppx-rxg9-jmrx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx	api/go.mod
critical	`osv/GHSA-f5wc-c3c7-36mc`: golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc	api/go.mod
critical	`osv/GHSA-vgwf-h737-ff37`: golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37	api/go.mod
critical	`osv/GHSA-89gr-r52h-f8rx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx	api/go.mod
critical	`osv/GHSA-rm3j-f69w-wqmq`: golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq	api/go.mod
critical	`osv/GHSA-5cgq-3rg8-m6cv`: golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv	api/go.mod
critical	`osv/GHSA-x527-x647-q7gg`: golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg	api/go.mod
critical	`osv/GHSA-5gmw-xhrv-c9v3`: [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3; also in worker/worker/package-lock.json	frontend/package-lock.json
critical	`osv/GHSA-85c8-ppgw-ccpr`: [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr; also in worker/worker/package-lock.json	frontend/package-lock.json
critical	`osv/GHSA-5xrq-8626-4rwp`: [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp; also in worker/worker/package-lock.json	frontend/package-lock.json
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	api/Dockerfile:4
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	frontend/Dockerfile:6
high	`osv/GHSA-q4h4-gmj2-qvw2`: golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2	api/go.mod
high	`osv/GHSA-w879-237q-wc7r`: golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r	api/go.mod
high	`osv/GHSA-3jxr-9vmj-r5cp`: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp	frontend/package-lock.json
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	frontend/package-lock.json
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	frontend/package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	frontend/package-lock.json
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	frontend/package-lock.json
high	`osv/GHSA-3jxr-9vmj-r5cp`: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp	frontend/package-lock.json
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	frontend/package-lock.json
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	frontend/package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	frontend/package-lock.json
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	frontend/package-lock.json
high	`osv/GHSA-73wf-gq98-2v4g`: [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g	frontend/package-lock.json

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 1,762; test lines: 545

Language	Lines
Go	1,143
HCL	571
TypeScript	527
SQL	40
JavaScript	26