RepoTrust

Leaderboard github.com

igianni84/newco-erp

  • View repository ↗
  • PHP
  • ★ 0
  • commit a7e06a512080
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

95%

explicit

Confidence
95%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

83/100

strong

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

52/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

95% explicit

Explicit AI attribution on 95% of first-party code added; an estimated 95% including velocity signals.

How the score is built

  • Explicitly attributed share95%
  • Unattributed share in AI-pace bursts3%
  • Estimated AI-generated share95%
  • AI tool configuration files43
  • Work sessions at AI pace15
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)0.07

Attributed AI tools

ToolCommitsLines addedFirst seenLast seen
Claude Code48689,2362026-06-112026-07-10

Lines added per month all AI-attributed share

  1. 2026-0669,350 · 96% AI
  2. 2026-0724,242 · 95% AI

Findings in AI-attributed lines vs the rest

From git blame: 40,314 lines trace to AI-attributed commits, 1,737 to others. Reported, not scored.

Findings per 1,000 linesAI-attributedOtherRatio
Code quality3.450.00—
Security3.940.00—

Evidence by analyzer

Explicit AI attributionok26 items
attributed_commit_share
87.1%
attributed_commits
486
attributed_loc
89,236
attributed_loc_share
95.3%
commits
558
effective_loc
93,592
tools_detected
1
AI tool configurationok43 items

3 more in the report JSON.

artifacts
43
earliest_adoption
2026-06-11
tools_configured
2
workflow_agents
0
Commit velocityok15 items
excluded_import_loc
0
flagged_loc
54,879
flagged_loc_share
58.6%
flagged_units
15
max_loc_per_hour
1,619.91
measured_loc
93,592
median_loc_per_hour
350.53
pr_timed_units
0
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
54
Release velocityskipped
Coding styleok2 items
count:assistant_voice
0
count:emoji_in_code
2
count:narrated_steps
2
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
2
files:narrated_steps
2
files:placeholder
0
index
0.07
lines_scanned
41,814
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0.05
per_kloc:narrated_steps
0.05
per_kloc:placeholder
0
Findings in AI-written linesok
ai_lines
40,314
blame_failures
0
files_blamed
510
other_lines
1,737
quality:ai_findings
139
quality:ai_per_kloc
3.45
quality:other_findings
0
quality:other_per_kloc
0
security:ai_findings
159
security:ai_per_kloc
3.94
security:other_findings
0
security:other_per_kloc
0

Code quality

83 strong

Code quality is strong: test-to-source ratio 1.14, CI runs tests; 2% of function code in complex or long functions; 5% duplicated lines. Weakest area: docs.

How the score is built

  • Complexity93
  • Duplication75
  • Lint and smells78
  • Tests and CI100
  • Documentation40
  • Type safetynot measured
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items
complex_functions
342
function_nloc
25,848
functions
15,549
long_functions
1
many_param_functions
21
mean_ccn
3.20
p90_ccn
7
risky_nloc_share
2.3%
Duplication (jscpd)ok10 items
compared_lines
27,461
duplicated_lines
1,301
duplicated_share
4.7%
files
510
Lintok
category:best-practice
6
category:correctness
133
findings
139
scanned_lines
42,051
weighted_findings
42.25
Tests and CIok3 items
  • CI config: .github/workflows/ci.yml .github/workflows/ci.yml
  • CI runs tests (phpunit)
  • CI runs linters (phpstan)
check:ci_present
yes
check:ci_runs_lint
yes
check:ci_runs_tests
yes
check:has_tests
yes
check:test_ratio
yes
check:tests_cochange
yes
ci_files
1
cochange_commits
133
cochange_share
96.2%
source_lines
42,051
test_lines
47,756
test_ratio
1.14
Documentationok1 item
  • README.md README.md
check:changelog
no
check:contributing
no
check:license
no
check:readme
yes
readme_lines
80
Type safetyskipped

Security

52 weak

Security posture is weak: 37 known vulnerabilities in 10 dependencies; 69 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.

How the score is built

  • Secrets100
  • Static analysis (SAST)54
  • Vulnerable dependencies31
  • CI workflows30
  • Security posture0
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
5
declared
5
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
159
findings_high
69
findings_low
0
findings_medium
90
parse_errors
20
scanned_lines
42,051
weighted_findings
74.25
Dependencies (osv-scanner)ok
penalty
70
vulnerabilities
37
vulnerable_packages
10
vulns_critical
1
vulns_high
14
vulns_low
4
vulns_medium
18
vulns_unknown
0
CI workflows (zizmor)ok
findings
8
findings_high
6
findings_low
2
findings_medium
0
penalty
72.60
workflows
1
Security postureok1 item
  • package.json has no lockfile alongside it (unpinned dependencies) package.json
check:dependency_updates
no
check:lockfiles
no
check:security_policy
no
check:signed_commits
no
signed_commit_share
0.0%
unpinned_manifests
1
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

1 critical89 high118 medium135 low

SeverityRuleLocationMessageTool
critical osv/GHSA-f9x3-7vq9-cph6 composer.lock laravel/[email protected] (Packagist) is affected by GHSA-f9x3-7vq9-cph6 Dependencies (osv-scanner)
high zizmor/unpinned-uses .github/workflows/ci.yml:110 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:113 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:124 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:37 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:40 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:51 unpinned action reference [confidence high] CI workflows (zizmor)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/CaseConfiguration.php:53 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/CompositeSku.php:60 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/Format.php:49 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/ProducerState.php:49 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/ProductMaster.php:65 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/ProductMasterWineAttributes.php:38 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/ProductReference.php:61 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/ProductVariant.php:65 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/ProductVariantWineAttributes.php:38 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/SellableSku.php:65 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Catalog/Models/VariantCaseWhitelistEntry.php:49 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Account.php:56 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Address.php:62 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Club.php:63 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/ClubCredit.php:65 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/ComplianceReview.php:63 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Customer.php:110 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Hold.php:60 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Producer.php:68 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/ProducerAgreement.php:58 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Profile.php:76 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Modules/Parties/Models/Supplier.php:43 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Platform/Audit/AuditRecord.php:40 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Platform/Events/DomainEvent.php:44 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-dangerous-model-construction app/Platform/Events/EventDelivery.php:33 Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] Static analysis (opengrep)
high osv/GHSA-2q4p-g7hv-5rgv composer.lock league/[email protected] (Packagist) is affected by GHSA-2q4p-g7hv-5rgv Dependencies (osv-scanner)
high osv/GHSA-2v3c-qxhr-7vpv composer.lock symfony/[email protected] (Packagist) is affected by GHSA-2v3c-qxhr-7vpv Dependencies (osv-scanner)
high osv/GHSA-3q6v-r5mr-hxv8 composer.lock league/[email protected] (Packagist) is affected by GHSA-3q6v-r5mr-hxv8 Dependencies (osv-scanner)
high osv/GHSA-4595-7fjw-r3jh composer.lock ueberdosis/[email protected] (Packagist) is affected by GHSA-4595-7fjw-r3jh Dependencies (osv-scanner)
high osv/GHSA-52xp-w8hr-xv3c composer.lock filament/[email protected] (Packagist) is affected by GHSA-52xp-w8hr-xv3c Dependencies (osv-scanner)
high osv/GHSA-8rr7-cvq3-gmfh composer.lock league/[email protected] (Packagist) is affected by GHSA-8rr7-cvq3-gmfh Dependencies (osv-scanner)
high osv/GHSA-f8fg-pg57-v4j8 composer.lock league/[email protected] (Packagist) is affected by GHSA-f8fg-pg57-v4j8 Dependencies (osv-scanner)
high osv/GHSA-g2gp-3wwq-f4ph composer.lock league/[email protected] (Packagist) is affected by GHSA-g2gp-3wwq-f4ph Dependencies (osv-scanner)
high osv/GHSA-j8pm-gj4c-rq4x composer.lock league/[email protected] (Packagist) is affected by GHSA-j8pm-gj4c-rq4x Dependencies (osv-scanner)
high osv/GHSA-jfm3-95jq-q3rf composer.lock league/[email protected] (Packagist) is affected by GHSA-jfm3-95jq-q3rf Dependencies (osv-scanner)
high osv/GHSA-jjv6-8j6v-6j52 composer.lock league/[email protected] (Packagist) is affected by GHSA-jjv6-8j6v-6j52 Dependencies (osv-scanner)
high osv/GHSA-mh25-x5hq-wrqp composer.lock league/[email protected] (Packagist) is affected by GHSA-mh25-x5hq-wrqp Dependencies (osv-scanner)
high osv/GHSA-r925-mgvr-h9cc composer.lock symfony/[email protected] (Packagist) is affected by GHSA-r925-mgvr-h9cc Dependencies (osv-scanner)
high osv/GHSA-v5mv-p594-2x33 composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-v5mv-p594-2x33 Dependencies (osv-scanner)
high opengrep/php.laravel.security.laravel-cookie-null-domain config/session.php:130 Found a configuration file where the domain attribute is not set to null. It is recommended (unless you are using sub-domain route registrations) to set this attribute to null so that only the same origin can set the cookie, thus... Static analysis (opengrep)
high opengrep/php.laravel.security.laravel-cookie-secure-set config/session.php:130 Found a configuration file where the secure attribute is not set to 'true'. Setting 'secure' to 'true' prevents the client from transmitting the cookie over unencrypted channels and therefore prevents cookies from being stolen through... Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/color-picker.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/color-picker.js:1 User controlled data in a `t.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:34 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:34 User controlled data in a `s.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:40 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:40 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:40 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:40 User controlled data in a `L.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:40 User controlled data in a `L.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:40 User controlled data in a `S.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/markdown-editor.js:51 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `v.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `x.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `x.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `x.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `x.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `x.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `x.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/markdown-editor.js:51 User controlled data in a `L.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/select.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/select.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/select.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/select.js:1 User controlled data in a `f.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/select.js:1 User controlled data in a `c.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/select.js:1 User controlled data in a `s.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/slider.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/forms/components/slider.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/slider.js:1 User controlled data in a `j[i].innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/forms/components/slider.js:1 User controlled data in a `k.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/tables/components/columns/select.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/tables/components/columns/select.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/js/filament/tables/components/columns/select.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/tables/components/columns/select.js:1 User controlled data in a `f.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/tables/components/columns/select.js:1 User controlled data in a `c.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/js/filament/tables/components/columns/select.js:1 User controlled data in a `s.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.best-practice.javascript-confirm public/js/filament/filament/app.js:1 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert public/js/filament/forms/components/markdown-editor.js:40 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-prompt public/js/filament/forms/components/markdown-editor.js:40 found prompt() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-prompt public/js/filament/forms/components/markdown-editor.js:40 found prompt() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert public/js/filament/forms/components/select.js:1 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert public/js/filament/tables/components/columns/select.js:1 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.correctness.no-replaceall public/js/filament/tables/components/columns/select.js:1 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall public/js/filament/tables/components/columns/text-input.js:1 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys public/js/filament/widgets/components/chart.js:3 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium opengrep/javascript.lang.correctness.no-stringify-keys public/js/filament/widgets/components/chart.js:3 JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. Lint
medium osv/GHSA-29pj-957v-52mc composer.lock league/[email protected] (Packagist) is affected by GHSA-29pj-957v-52mc Dependencies (osv-scanner)
medium osv/GHSA-5wcm-3v2w-8362 composer.lock laravel/[email protected] (Packagist) is affected by GHSA-5wcm-3v2w-8362 Dependencies (osv-scanner)
medium osv/GHSA-7m6h-rg42-m449 composer.lock filament/[email protected] (Packagist) is affected by GHSA-7m6h-rg42-m449 Dependencies (osv-scanner)
medium osv/GHSA-94pj-82f3-465w composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-94pj-82f3-465w Dependencies (osv-scanner)
medium osv/GHSA-97jj-33gv-5xf9 composer.lock league/[email protected] (Packagist) is affected by GHSA-97jj-33gv-5xf9 Dependencies (osv-scanner)
medium osv/GHSA-c2w2-prh8-qm98 composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-c2w2-prh8-qm98 Dependencies (osv-scanner)
medium osv/GHSA-cwxw-98qj-8qjx composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-cwxw-98qj-8qjx Dependencies (osv-scanner)
medium osv/GHSA-f283-ghqc-fg79 composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-f283-ghqc-fg79 Dependencies (osv-scanner)
medium osv/GHSA-f7vp-7xgx-4w4r composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-f7vp-7xgx-4w4r Dependencies (osv-scanner)
medium osv/GHSA-g3hc-697w-wm82 composer.lock livewire/[email protected] (Packagist) is affected by GHSA-g3hc-697w-wm82 Dependencies (osv-scanner)
medium osv/GHSA-g446-98w2-8p5w composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-g446-98w2-8p5w Dependencies (osv-scanner)
medium osv/GHSA-h95v-h523-3mw8 composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-h95v-h523-3mw8 Dependencies (osv-scanner)
medium osv/GHSA-mhf7-xp6r-6qrc composer.lock livewire/[email protected] (Packagist) is affected by GHSA-mhf7-xp6r-6qrc Dependencies (osv-scanner)
medium osv/GHSA-mj63-m3rc-8ppr composer.lock league/[email protected] (Packagist) is affected by GHSA-mj63-m3rc-8ppr Dependencies (osv-scanner)
medium osv/GHSA-r3j6-gpjw-qfjr composer.lock filament/[email protected] (Packagist) is affected by GHSA-r3j6-gpjw-qfjr Dependencies (osv-scanner)
medium osv/GHSA-vm85-hxw5-5432 composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-vm85-hxw5-5432 Dependencies (osv-scanner)
medium osv/GHSA-wm3w-8rrp-j577 composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-wm3w-8rrp-j577 Dependencies (osv-scanner)
medium osv/GHSA-wpwq-4j6v-78m3 composer.lock guzzlehttp/[email protected] (Packagist) is affected by GHSA-wpwq-4j6v-78m3 Dependencies (osv-scanner)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/filament/app.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/filament/echo.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/filament/echo.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/filament/echo.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/filament/echo.js:2 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/filament/echo.js:2 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/color-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/color-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/color-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/color-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/color-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/color-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/color-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/color-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string public/js/filament/forms/components/color-picker.js:1 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string public/js/filament/forms/components/color-picker.js:1 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/date-time-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/date-time-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/date-time-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/date-time-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/date-time-picker.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos public/js/filament/forms/components/date-time-picker.js:1 Detected the use of a regular expression `D[oD]?(\[[^\[\]]*\]|\s)+MMMM?|MMMM?(\[[^\[\]]*\]|\s)+D[oD]?` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos public/js/filament/forms/components/date-time-picker.js:1 Detected the use of a regular expression `D[oD]?(\[[^[\]]*\]|\s)+MMMM?` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos public/js/filament/forms/components/date-time-picker.js:1 Detected the use of a regular expression `D[oD]?(\[[^[\]]*\]|\s)+MMMM?` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos public/js/filament/forms/components/date-time-picker.js:1 Detected the use of a regular expression `D[oD]?(\[[^[\]]*\]|\s)+MMMM?` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/date-time-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/date-time-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/date-time-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/date-time-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/date-time-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/date-time-picker.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:12 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:12 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos public/js/filament/forms/components/markdown-editor.js:32 Detected the use of a regular expression `^\b(([gimyus])(?![gimyus]*\2))+\b` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos public/js/filament/forms/components/markdown-editor.js:32 Detected the use of a regular expression `^([*\-_])(?:\s*\1){2,}\s*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos public/js/filament/forms/components/markdown-editor.js:32 Detected the use of a regular expression... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:32 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:4 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/forms/components/markdown-editor.js:5 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/slider.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/slider.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/slider.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/slider.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/forms/components/slider.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/forms/components/slider.js:1 RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/forms/components/slider.js:1 RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/forms/components/tags-input.js:1 RegExp() called with a `{state:n,splitKeys:a}` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/tables/tables.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/tables/tables.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/tables/tables.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop public/js/filament/widgets/components/chart.js:1 Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `{numberingSystem:s}` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `...s` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `s` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `p` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp public/js/filament/widgets/components/chart.js:3 RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop public/js/filament/widgets/components/stats-overview/stat/chart.js:1 Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/stats-overview/stat/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/stats-overview/stat/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/stats-overview/stat/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method public/js/filament/widgets/components/stats-overview/stat/chart.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector public/js/filament/widgets/components/stats-overview/stat/chart.js:3 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/filament/app.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/filament/echo.js:1 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/filament/echo.js:2 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator public/js/filament/forms/components/color-picker.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator public/js/filament/forms/components/color-picker.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/color-picker.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/date-time-picker.js:1 `W` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/date-time-picker.js:1 `fe` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/date-time-picker.js:1 `b` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/date-time-picker.js:1 `d` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/date-time-picker.js:1 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:1 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:10 `Y` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:10 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:10 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:10 `f` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:10 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:10 `r.gutterMarkers` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:10 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:11 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:15 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:19 `Ve` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:3 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.eqeq-is-bad public/js/filament/forms/components/markdown-editor.js:32 Detected a useless comparison operation `q == q` or `q != q`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex. Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator public/js/filament/forms/components/markdown-editor.js:32 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator public/js/filament/forms/components/markdown-editor.js:32 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator public/js/filament/forms/components/markdown-editor.js:32 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator public/js/filament/forms/components/markdown-editor.js:32 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:32 `I` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:32 `we` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:32 `R` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:32 `le` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:32 `ce` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:34 `g` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:34 `T` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.eqeq-is-bad public/js/filament/forms/components/markdown-editor.js:4 Detected a useless comparison operation `$t == $t` or `$t != $t`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex. Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:4 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:4 `l` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:40 `v` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:40 `E` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.eqeq-is-bad public/js/filament/forms/components/markdown-editor.js:5 Detected a useless comparison operation `r == r` or `r != r`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex. Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:5 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:5 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:5 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/markdown-editor.js:5 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/select.js:1 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/select.js:1 `F` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/select.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/select.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/slider.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/slider.js:1 `k` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/slider.js:1 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/forms/components/slider.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/tables/components/columns/select.js:1 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/tables/components/columns/select.js:1 `z` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/tables/components/columns/select.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/tables/components/columns/select.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/tables/tables.js:1 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/tables/tables.js:1 `f` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i.garbageCollect` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `_` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/chart.js:3 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `o` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `o` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s.garbageCollect` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `v` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `o` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:3 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment public/js/filament/widgets/components/stats-overview/stat/chart.js:3 `s` is assigned twice; the first assignment is useless Lint
low opengrep/bash.lang.correctness.unquoted-command-substitution-in-command ralph.sh:176 The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. Lint
low opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command ralph.sh:204 Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... Lint
low opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command ralph.sh:226 Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... Lint
low opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command scripts/spec-staleness.sh:132 Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... Lint
low opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command scripts/spec-staleness.sh:158 Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... Lint
low zizmor/artipacked .github/workflows/ci.yml:109 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/ci.yml:36 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low osv/GHSA-63hm-g96r-2m2q composer.lock laravel/[email protected] (Packagist) is affected by GHSA-63hm-g96r-2m2q Dependencies (osv-scanner)
low osv/GHSA-cxf4-7mrp-vvpr composer.lock league/[email protected] (Packagist) is affected by GHSA-cxf4-7mrp-vvpr Dependencies (osv-scanner)
low osv/GHSA-jh5r-qr3c-85q8 composer.lock laravel/[email protected] (Packagist) is affected by GHSA-jh5r-qr3c-85q8 Dependencies (osv-scanner)
low osv/GHSA-xwpv-pqxp-5v36 composer.lock filament/[email protected] (Packagist) is affected by GHSA-xwpv-pqxp-5v36 Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Findings in AI-written linesAI provenanceokgit-blame0
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b414139
Tests and CICode qualityok—0
Type safetyCode qualityskipped—0
CI workflows (zizmor)Securityokzizmor 1.32.08
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.137
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b414159
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-14a7e06a512080prov-5+qual-2+sec-295%8352
2026-11-14a7e06a512080prov-4+qual-2+sec-295%8352

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/igianni84/newco-erp/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/igianni84/newco-erp/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/igianni84/newco-erp/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/igianni84/newco-erp/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/igianni84/newco-erp/security.svg)](https://repotrust.synapticcyber.com/r/github.com/igianni84/newco-erp/)
Full text report
  • Repository: https://github.com/igianni84/newco-erp
  • Commit: a7e06a5120809e75a220d55be2ae73f8c197797a
  • Generated: 2026-11-14T14:52:05+00:00
  • Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 95 explicit 95% 100%
Code quality 83 strong 90% 100%
Security 52 weak 85% 100%

AI provenance

Explicit AI attribution on 95% of first-party code added; an estimated 95% including velocity signals.

  • Explicitly attributed share (lower bound): 95.3%
  • Unattributed share in AI-consistent velocity bursts: 3.4%
  • Estimated AI-generated share: 95.3%
AI tool Attributed commits Lines added
Claude Code 486 89,236
  • AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 40,314 of 42,051.

Findings per 1,000 lines AI-attributed Other Ratio
Quality 3.448 0.0 n/a
Security 3.944 0.0 n/a
  • Stylometry index: 0.07 per 1,000 lines (narrated steps 2, placeholders 0, assistant phrasing 0, emoji 2). Reported as a signal, not scored.
Month Lines added Attributed to AI
2026-06 69,350 96%
2026-07 24,242 95%

Evidence

  • Claude Code: trailer 'Co-Authored-By: Claude' (a7e06a512080)
  • Claude Code: trailer 'Co-Authored-By: Claude' (b42d0f53faae)
  • Claude Code: trailer 'Co-Authored-By: Claude' (d43574220cba)
  • Claude Code: trailer 'Co-Authored-By: Claude' (aaec37ef48af)
  • Claude Code: trailer 'Co-Authored-By: Claude' (4affa5579b54)
  • Claude Code: trailer 'Co-Authored-By: Claude' (b7593bb1f9e5)
  • Claude Code: trailer 'Co-Authored-By: Claude' (95ec77a14b18)
  • Claude Code: trailer 'Co-Authored-By: Claude' (c0814f6abf33)
  • Claude Code: trailer 'Co-Authored-By: Claude' (feb2511a821d)
  • Claude Code: trailer 'Co-Authored-By: Claude' (5f25467f23e2)
  • Claude Code: trailer 'Co-Authored-By: Claude' (1d3d941dc5ea)
  • Claude Code: trailer 'Co-Authored-By: Claude' (2307fc87854d)
  • Claude Code: trailer 'Co-Authored-By: Claude' (492a49a17a79)
  • Claude Code: trailer 'Co-Authored-By: Claude' (5be433be4d64)
  • Claude Code: trailer 'Co-Authored-By: Claude' (9b19bece474e)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 1.14, CI runs tests; 2% of function code in complex or long functions; 5% duplicated lines. Weakest area: docs.

Area Score
Complexity (lizard) 93
Duplication 75
Code smells (Opengrep) 78
Tests and CI 100
Documentation 40
Type safety n/a
Process (Scorecard review/maintenance) n/a
  • Functions: 15,549; mean complexity 3.2, 90th percentile 7; 342 complex and 1 long functions
  • Duplicated lines: 4.7% of 27,461 compared
  • Tests: 47,756 test lines for 42,051 source lines (ratio 1.14); CI test commands: phpunit; 96% of recent source commits also change tests
  • Docs missing or thin: license, contributing, changelog

Most complex functions:

Security

Security posture is weak: 37 known vulnerabilities in 10 dependencies; 69 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 54
Vulnerable dependencies (OSV) 31
CI workflows (zizmor) 30
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a

  • Known vulnerabilities: 37 in 10 packages (critical 1, high 14, medium 18, low 4)

  • Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity Finding Location
critical osv/GHSA-f9x3-7vq9-cph6: laravel/[email protected] (Packagist) is affected by GHSA-f9x3-7vq9-cph6 composer.lock
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/CaseConfiguration.php:53
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/CompositeSku.php:60
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/Format.php:49
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/ProducerState.php:49
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/ProductMaster.php:65
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/ProductMasterWineAttributes.php:38
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/ProductReference.php:61
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/ProductVariant.php:65
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/ProductVariantWineAttributes.php:38
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/SellableSku.php:65
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Catalog/Models/VariantCaseWhitelistEntry.php:49
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Account.php:56
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Address.php:62
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Club.php:63
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/ClubCredit.php:65
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/ComplianceReview.php:63
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Customer.php:110
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Hold.php:60
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Producer.php:68
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/ProducerAgreement.php:58
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Profile.php:76
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Modules/Parties/Models/Supplier.php:43
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Platform/Audit/AuditRecord.php:40
high opengrep/php.laravel.security.laravel-dangerous-model-construction: Setting $guarded to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low] app/Platform/Events/DomainEvent.php:44

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 42,051; test lines: 47,756
Language Lines
PHP 88,423
Shell 854
JavaScript 530