Leaderboard github.com
l-baglini/signal42-training-repository
AI provenance
21%
explicit
- Confidence
- 81%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
54/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
53/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
21% explicit
Explicit AI attribution on 21% of first-party code added; an estimated 21% including velocity signals.
How the score is built
- Explicitly attributed share21%
- Unattributed share in AI-pace bursts26%
- Estimated AI-generated share21%
- AI tool configuration files12
- Work sessions at AI pace5
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)3.08
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 7 | 10,996 | 2026-06-18 | 2026-07-10 |
Lines added per month all AI-attributed share
- 2026-0652,021 · 21% AI
- 2026-07585 · 8% AI
Findings in AI-attributed lines vs the rest
From git blame: 10,891 lines trace to AI-attributed commits, 32,462 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 1.10 | 3.27 | 0.34× |
| Security | 0.18 | 1.54 | 0.12× |
Evidence by analyzer
Explicit AI attributionok8 items
- Claude Code: 7 attributed commits, 10,996 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- attributed_commit_share
- 15.9%
- attributed_commits
- 7
- attributed_loc
- 10,996
- attributed_loc_share
- 20.9%
- commits
- 44
- effective_loc
- 52,606
- tools_detected
- 1
AI tool configurationok12 items
- homework-01/dario-triolo/CLAUDE.md (claude-code configuration)
- homework-01/f-pettrone/maze-cli-escape/CLAUDE.md (claude-code configuration)
- homework-01/federico-liccione/CLAUDE.md (claude-code configuration)
- homework-01/federico-quaglia/CLAUDE.md (claude-code configuration)
- homework-01/gabriV/CLAUDE.md (claude-code configuration)
- homework-01/marioben/code-lens/CLAUDE.md (claude-code configuration)
- homework-01/mdand/CLAUDE.md (claude-code configuration)
- homework-01/michele_bertagni/CLAUDE.md (claude-code configuration)
- homework-01/rosario/gatherer/CLAUDE.md (claude-code configuration)
- homework-01/sasero/claude-monitor-usage/CLAUDE.md (claude-code configuration)
- homework-01/sasero/office-chaos/CLAUDE.md (claude-code configuration)
- homework-01/federico-liccione/AGENTS.md (generic-agent configuration)
- artifacts
- 12
- earliest_adoption
- 2026-06-16
- tools_configured
- 2
- workflow_agents
- 0
Commit velocityok5 items
- 5,347 lines of first-party code in ~4.1h (1,320 lines/hour, 2 commit session)
- 3,376 lines of first-party code in ~4.2h (810 lines/hour, PR #5)
- 5,869 lines of first-party code in ~7.3h (804 lines/hour, PR #12)
- 2,802 lines of first-party code in ~3.9h (715 lines/hour, 2 commit session)
- 2,320 lines of first-party code in ~4.1h (572 lines/hour, PR #11)
- excluded_import_loc
- 20,858
- flagged_loc
- 19,714
- flagged_loc_share
- 62.1%
- flagged_units
- 5
- max_loc_per_hour
- 1,319.88
- measured_loc
- 31,748
- median_loc_per_hour
- 247.90
- pr_timed_units
- 14
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 19
Release velocityskipped
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 267
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 60
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 3.08
- lines_scanned
- 43,353
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 6.16
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 10,891
- blame_failures
- 0
- files_blamed
- 416
- other_lines
- 32,462
- quality:ai_findings
- 12
- quality:ai_per_kloc
- 1.10
- quality:other_findings
- 106
- quality:other_per_kloc
- 3.27
- quality:ratio
- 0.34
- security:ai_findings
- 2
- security:ai_per_kloc
- 0.18
- security:other_findings
- 50
- security:other_per_kloc
- 1.54
- security:ratio
- 0.12
Code quality
54 weak
Code quality is weak: test-to-source ratio 0.03, no CI test run detected; 12% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.
How the score is built
- Complexity70
- Duplication87
- Lint and smells46
- Tests and CI29
- Documentation40
- Type safety76
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- runPipeline in homework-01/federico-liccione/src/lib/pipeline.ts: complexity 44, 102 lines
- _loop in homework-01/sasero/office-chaos/client/src/game/three/Scene.js: complexity 36, 77 lines
- makeFurniture in homework-01/sasero/office-chaos/client/src/game/three/catalog.js: complexity 31, 137 lines
- simTick in homework-01/sasero/office-chaos/server/src/game/rooms.js: complexity 29, 44 lines
- validateLayout in homework-01/sasero/office-chaos/server/src/game/map.js: complexity 27, 29 lines
- RegisterPage in homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx: complexity 27, 184 lines
- update in homework-01/matteo/space-invaders/game.js: complexity 26, 74 lines
- move in homework-01/michele_bertagni/game.js: complexity 24, 30 lines
- diagnose in homework-01/federico-quaglia/analyzer.py: complexity 23, 60 lines
- draw in homework-01/michele_bertagni/game.js: complexity 23, 43 lines
- complex_functions
- 21
- function_nloc
- 23,005
- functions
- 2,304
- long_functions
- 14
- many_param_functions
- 2
- mean_ccn
- 2.60
- p90_ccn
- 6
- risky_nloc_share
- 11.8%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: homework-01/diego-tomba/app/api/repos/[id]/route.ts:13 and homework-01/diego-tomba/app/api/repos/route.ts:15
- 6+ duplicated lines: homework-01/diego-tomba/components/charts/spend-over-time.tsx:57 and homework-01/diego-tomba/components/charts/usage-by-task.tsx:53
- 6+ duplicated lines: homework-01/diego-tomba/components/tabs/prompts-tab.tsx:109 and homework-01/diego-tomba/components/tabs/repos-tab.tsx:178
- 6+ duplicated lines: homework-01/diego-tomba/lib/api-client.ts:14 and homework-01/diego-tomba/src/infrastructure/persistence/prisma/prisma-watched-repo.repository.ts:17
- 6+ duplicated lines: homework-01/diego-tomba/lib/server-container.ts:25 and homework-01/diego-tomba/worker/scheduler.ts:27
- 6+ duplicated lines: homework-01/diego-tomba/prisma/migrations/20260618133303_init/migration.sql:29 and homework-01/diego-tomba/prisma/migrations/20260618144429_report_token_usage/migration.sql:5
- 6+ duplicated lines: homework-01/diego-tomba/src/domain/entities/estimate.ts:6 and homework-01/diego-tomba/src/domain/services/estimator.service.ts:8
- 6+ duplicated lines: homework-01/diego-tomba/src/infrastructure/github/octokit-git-platform.adapter.ts:74 and homework-01/diego-tomba/src/infrastructure/github/octokit-git-platform.adapter.ts:126
- 6+ duplicated lines: homework-01/f-pettrone/maze-cli-escape/lib/input_reader.dart:72 and homework-01/f-pettrone/maze-cli-escape/lib/input_reader.dart:83
- 6+ duplicated lines: homework-01/federico-liccione/scripts/dedup-mit.ts:6 and homework-01/federico-liccione/scripts/regeocode.ts:8
- compared_lines
- 31,421
- duplicated_lines
- 751
- duplicated_share
- 2.4%
- files
- 416
Lintok
- category:best-practice
- 70
- category:correctness
- 16
- category:maintainability
- 32
- findings
- 118
- scanned_lines
- 41,903
- weighted_findings
- 129.75
Tests and CIok
- check:ci_present
- no
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 0
- cochange_commits
- 31
- cochange_share
- 19.4%
- source_lines
- 43,353
- test_lines
- 1,418
- test_ratio
- 0.03
Documentationok1 item
- README.md
README.md
- check:changelog
- no
- check:contributing
- no
- check:license
- no
- check:readme
- yes
- readme_lines
- 39
Type safetyok1 item
- TypeScript strict type checking: homework-01/diego-tomba/tsconfig.json
homework-01/diego-tomba/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 21
- escapes_per_kloc
- 0.89
Security
53 weak
Security posture is weak: 328 known vulnerabilities in 53 dependencies; 22 high-severity SAST findings. Weakest area: posture.
How the score is built
- Secrets97
- Static analysis (SAST)78
- Vulnerable dependencies0
- CI workflowsnot measured
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 110
- declared
- 110
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 1
Static analysis (opengrep)ok
- findings
- 59
- findings_high
- 22
- findings_low
- 5
- findings_medium
- 32
- parse_errors
- 2
- scanned_lines
- 41,903
- weighted_findings
- 29.71
Dependencies (osv-scanner)ok
- penalty
- 410
- vulnerabilities
- 328
- vulnerable_packages
- 53
- vulns_critical
- 19
- vulns_high
- 135
- vulns_low
- 27
- vulns_medium
- 144
- vulns_unknown
- 3
CI workflows (zizmor)skipped
Security postureok3 items
- homework-01/sasero/office-chaos/client/package.json has no lockfile alongside it (unpinned dependencies)
homework-01/sasero/office-chaos/client/package.json - homework-01/sasero/office-chaos/server/package.json has no lockfile alongside it (unpinned dependencies)
homework-01/sasero/office-chaos/server/package.json - homework-01/tommasoNocchi/frontend/package.json has no lockfile alongside it (unpinned dependencies)
homework-01/tommasoNocchi/frontend/package.json
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 40.9%
- unpinned_manifests
- 3
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
19 critical164 high286 medium9 low
478 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-2464-fhr4-w9xw |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw | Dependencies (osv-scanner) |
| critical | osv/GHSA-2xp9-vwfh-vxw4 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4 | Dependencies (osv-scanner) |
| critical | osv/GHSA-p293-qw3h-jr36 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-p293-qw3h-jr36 | Dependencies (osv-scanner) |
| critical | osv/GHSA-v5rq-49vh-5v5c |
homework-01/ema/gitdash/package-lock.json | @simple-git/[email protected] (npm) is affected by GHSA-v5rq-49vh-5v5c | Dependencies (osv-scanner) |
| critical | osv/GHSA-x6jw-m9v5-85vh |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-x6jw-m9v5-85vh | Dependencies (osv-scanner) |
| critical | osv/GHSA-2464-fhr4-w9xw |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw | Dependencies (osv-scanner) |
| critical | osv/GHSA-2xp9-vwfh-vxw4 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4 | Dependencies (osv-scanner) |
| critical | osv/GHSA-5gmw-xhrv-c9v3 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 | Dependencies (osv-scanner) |
| critical | osv/GHSA-5xrq-8626-4rwp |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp | Dependencies (osv-scanner) |
| critical | osv/GHSA-85c8-ppgw-ccpr |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr | Dependencies (osv-scanner) |
| critical | osv/GHSA-jqcg-44mw-7w3h |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h; also in homework-01/sasero/claude-monitor-usage/package-lock.json; also in homework-04/package-lock.json | Dependencies (osv-scanner) |
| critical | osv/GHSA-p293-qw3h-jr36 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-p293-qw3h-jr36 | Dependencies (osv-scanner) |
| critical | osv/GHSA-332p-7hrc-92wf |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf | Dependencies (osv-scanner) |
| critical | osv/GHSA-3f63-hfp8-52jq |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq | Dependencies (osv-scanner) |
| critical | osv/GHSA-5x8w-8jj5-q52h |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h | Dependencies (osv-scanner) |
| critical | osv/GHSA-8g5g-8vmr-9782 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 | Dependencies (osv-scanner) |
| critical | osv/GHSA-w889-685w-c8fh |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh | Dependencies (osv-scanner) |
| critical | osv/GHSA-xvh5-g6gv-559v |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v | Dependencies (osv-scanner) |
| critical | osv/GHSA-3qf3-8w2g-rqmx |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2024-232, PYSEC-2026-4298, GHSA-3qf3-8w2g-rqmx, GHSA-6c5p-j8vq-pqhj | Dependencies (osv-scanner) |
| high | opengrep/python.lang.maintainability.useless-inner-function |
homework-01/mlucchesi/workbreak/modules/dashboard.py:454 | function `_refresh_display` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
homework-01/mlucchesi/workbreak/modules/lock_screen.py:193 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
homework-01/mlucchesi/workbreak/modules/lock_screen.py:253 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
homework-01/mlucchesi/workbreak/modules/lock_screen.py:817 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
homework-01/mlucchesi/workbreak/modules/lock_screen.py:852 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
homework-01/mlucchesi/workbreak/modules/timer_engine.py:109 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
homework-01/mlucchesi/workbreak/modules/timer_engine.py:150 | time.sleep() call; did you mean to leave this in? | Lint |
| high | osv/GHSA-28wg-ghj8-5hjv |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv; also in homework-01/diego-tomba/package-lock.json; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in... | Dependencies (osv-scanner) |
| high | osv/GHSA-2v37-7h3g-55p8 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8; also in homework-01/diego-tomba/package-lock.json; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in... | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q; also in homework-01/diego-tomba/package-lock.json; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in... | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in... | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in... | Dependencies (osv-scanner) |
| high | osv/GHSA-r28c-9q8g-f849 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-r28c-9q8g-f849; also in homework-01/diego-tomba/package-lock.json; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in... | Dependencies (osv-scanner) |
| high | osv/GHSA-6g55-p6wh-862q |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-6g55-p6wh-862q; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-89xv-2m56-2m9x |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-89xv-2m56-2m9x | Dependencies (osv-scanner) |
| high | osv/GHSA-f88m-g3jw-g9cj |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-f88m-g3jw-g9cj | Dependencies (osv-scanner) |
| high | osv/GHSA-ggr8-5vv4-36mx |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-ggr8-5vv4-36mx | Dependencies (osv-scanner) |
| high | osv/GHSA-m99w-x7hq-7vfj |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-m99w-x7hq-7vfj | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5; also in homework-01/federico-liccione/package-lock.json; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-p3m5-59mp-jv5r |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-p3m5-59mp-jv5r | Dependencies (osv-scanner) |
| high | osv/GHSA-p9j2-gv94-2wf4 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-p9j2-gv94-2wf4 | Dependencies (osv-scanner) |
| high | osv/GHSA-r28c-9q8g-f849 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-r28c-9q8g-f849; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-rgj7-g3m4-5g8c |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-rgj7-g3m4-5g8c | Dependencies (osv-scanner) |
| high | osv/GHSA-w5hq-g745-h8pq |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq | Dependencies (osv-scanner) |
| high | osv/GHSA-wq5f-xc86-pv6w |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-wq5f-xc86-pv6w | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-4cwx-7wf7-3272 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-4cwx-7wf7-3272; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-4w7w-5xrc-9h26 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-858h-whjf-mvg5 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-858h-whjf-mvg5 | Dependencies (osv-scanner) |
| high | osv/GHSA-9qh4-3jw8-366w |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-9qh4-3jw8-366w; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-g4wm-2vf7-vfgr |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-g4wm-2vf7-vfgr | Dependencies (osv-scanner) |
| high | osv/GHSA-gr2m-v5gq-v685 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-gr2m-v5gq-v685; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-hm92-r4w5-c3mj |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-hm92-r4w5-c3mj; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-hq2x-r82h-9wj4 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-hq2x-r82h-9wj4; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-j84w-jfhq-vhvj |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-j84w-jfhq-vhvj; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-jr5w-w6x2-84p9 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-jr5w-w6x2-84p9; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-qmv3-fv6v-rmhq |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-qmv3-fv6v-rmhq; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-rfgv-xxqx-mfg5 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-vmh5-mc38-953g |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-vmh5-mc38-953g; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-vxpw-j846-p89q |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-vxpw-j846-p89q; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-w293-vg96-wgc3 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-w293-vg96-wgc3; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-4cwx-7wf7-3272 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-4cwx-7wf7-3272 | Dependencies (osv-scanner) |
| high | osv/GHSA-4w7w-5xrc-9h26 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-rfgv-xxqx-mfg5 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5 | Dependencies (osv-scanner) |
| high | osv/GHSA-w293-vg96-wgc3 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-w293-vg96-wgc3 | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | osv/GHSA-22jm-h49p-29qw |
homework-01/federico-liccione/package-lock.json | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-22jm-h49p-29qw | Dependencies (osv-scanner) |
| high | osv/GHSA-27r3-jxmh-p828 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-2x7j-588g-ccc2 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-2x7j-588g-ccc2 | Dependencies (osv-scanner) |
| high | osv/GHSA-36qx-fr4f-26g5 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-36qx-fr4f-26g5 | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-46jr-4wx8-v453 |
homework-01/federico-liccione/package-lock.json | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453 | Dependencies (osv-scanner) |
| high | osv/GHSA-4c8g-83qw-93j6 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4c8g-83qw-93j6 | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-6qxp-vccf-f47h |
homework-01/federico-liccione/package-lock.json | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-6qxp-vccf-f47h | Dependencies (osv-scanner) |
| high | osv/GHSA-7p8r-x3mc-p8w7 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7 | Dependencies (osv-scanner) |
| high | osv/GHSA-89xv-2m56-2m9x |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-89xv-2m56-2m9x | Dependencies (osv-scanner) |
| high | osv/GHSA-8h8q-6873-q5fj |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-8h8q-6873-q5fj | Dependencies (osv-scanner) |
| high | osv/GHSA-c4j6-fc7j-m34r |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-c4j6-fc7j-m34r | Dependencies (osv-scanner) |
| high | osv/GHSA-f65p-4m7j-42xc |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc | Dependencies (osv-scanner) |
| high | osv/GHSA-f897-62hf-6gxq |
homework-01/federico-liccione/package-lock.json | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq | Dependencies (osv-scanner) |
| high | osv/GHSA-fph4-wmhf-6fwf |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-fph4-wmhf-6fwf | Dependencies (osv-scanner) |
| high | osv/GHSA-h25m-26qc-wcjf |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-h25m-26qc-wcjf | Dependencies (osv-scanner) |
| high | osv/GHSA-jqff-g426-hqxp |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-jqff-g426-hqxp | Dependencies (osv-scanner) |
| high | osv/GHSA-m99w-x7hq-7vfj |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-m99w-x7hq-7vfj | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mwp4-54f8-5fhr |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr | Dependencies (osv-scanner) |
| high | osv/GHSA-p3m5-59mp-jv5r |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-p3m5-59mp-jv5r | Dependencies (osv-scanner) |
| high | osv/GHSA-p9j2-gv94-2wf4 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-p9j2-gv94-2wf4 | Dependencies (osv-scanner) |
| high | osv/GHSA-q4gf-8mx6-v5v3 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-q4gf-8mx6-v5v3 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-qw65-cvwx-89v3 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-v2hh-gcrm-f6hx |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-v2hh-gcrm-f6hx | Dependencies (osv-scanner) |
| high | osv/GHSA-v53p-9fqp-m79j |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-v53p-9fqp-m79j | Dependencies (osv-scanner) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
homework-01/federico-quaglia/analyzer.py:225 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-01/gabriV/web/js/hud.js:102 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-01/gabriV/web/js/hud.js:102 | User controlled data in a `line.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-01/gabriV/web/js/lobby.js:11 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-01/gabriV/web/js/lobby.js:11 | User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-01/gabriV/web/js/options.js:12 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-01/gabriV/web/js/options.js:12 | User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | osv/GHSA-587h-7wmj-h5pm |
homework-01/marioben/code-lens/frontend/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-01/matteo/space-invaders/game.js:318 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-01/matteo/space-invaders/game.js:318 | User controlled data in a `ov.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
homework-01/mlucchesi/workbreak/modules/dashboard.py:45 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
homework-01/mlucchesi/workbreak/modules/dashboard.py:50 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
homework-01/mlucchesi/workbreak/modules/timer_engine.py:25 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | osv/GHSA-22hg-r758-rrw9 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9 | Dependencies (osv-scanner) |
| high | osv/GHSA-27h8-gf7j-v5hc |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc | Dependencies (osv-scanner) |
| high | osv/GHSA-3j72-p6qg-6xp7 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7 | Dependencies (osv-scanner) |
| high | osv/GHSA-44wm-f244-xhp3 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3 | Dependencies (osv-scanner) |
| high | osv/GHSA-4558-3h8r-v8xp |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp | Dependencies (osv-scanner) |
| high | osv/GHSA-45hq-cxwh-f6vc |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc | Dependencies (osv-scanner) |
| high | osv/GHSA-58r4-6rv3-gfh8 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5x94-69rx-g8h2 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2 | Dependencies (osv-scanner) |
| high | osv/GHSA-5xm2-6676-qcp9 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9 | Dependencies (osv-scanner) |
| high | osv/GHSA-62p4-gmf7-7g93 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93 | Dependencies (osv-scanner) |
| high | osv/GHSA-65qm-jvmh-6pqg |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg | Dependencies (osv-scanner) |
| high | osv/GHSA-6r8x-57c9-28j4 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4 | Dependencies (osv-scanner) |
| high | osv/GHSA-7mwm-ghpf-9vrm |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm | Dependencies (osv-scanner) |
| high | osv/GHSA-8v84-f9pq-wr9x |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x | Dependencies (osv-scanner) |
| high | osv/GHSA-9hw9-ch79-4vh6 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6 | Dependencies (osv-scanner) |
| high | osv/GHSA-9v9v-9qvf-h2hj |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj | Dependencies (osv-scanner) |
| high | osv/GHSA-c6hw-5grf-ff96 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96 | Dependencies (osv-scanner) |
| high | osv/GHSA-f2g6-542v-9j58 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58 | Dependencies (osv-scanner) |
| high | osv/GHSA-g7cr-3p24-7wf7 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7 | Dependencies (osv-scanner) |
| high | osv/GHSA-g842-9rc4-69pw |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw | Dependencies (osv-scanner) |
| high | osv/GHSA-gg2r-wvfm-q9rx |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx | Dependencies (osv-scanner) |
| high | osv/GHSA-j4m9-6w36-pw47 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47 | Dependencies (osv-scanner) |
| high | osv/GHSA-j7hp-h8jx-5ppr |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr | Dependencies (osv-scanner) |
| high | osv/GHSA-jg86-v3jv-hrpm |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm | Dependencies (osv-scanner) |
| high | osv/GHSA-jjj6-mw9f-p565 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrfp-p49p-3hf2 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2 | Dependencies (osv-scanner) |
| high | osv/GHSA-p4wg-p73j-c528 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528 | Dependencies (osv-scanner) |
| high | osv/GHSA-pchr-8j38-3x4p |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p | Dependencies (osv-scanner) |
| high | osv/GHSA-phj9-mv4w-65pm |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm | Dependencies (osv-scanner) |
| high | osv/GHSA-q45j-58j2-45rg |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg | Dependencies (osv-scanner) |
| high | osv/GHSA-qr4w-53vh-m672 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-qr4w-53vh-m672 | Dependencies (osv-scanner) |
| high | osv/GHSA-vjc4-5qp5-m44j |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j | Dependencies (osv-scanner) |
| high | osv/GHSA-xcvg-w56q-r89m |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m | Dependencies (osv-scanner) |
| high | osv/GHSA-xgh8-jp6q-p5x8 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8 | Dependencies (osv-scanner) |
| high | osv/GHSA-xj96-63gp-2gmr |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr | Dependencies (osv-scanner) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
homework-01/rosario/gatherer/backend/Dockerfile:20 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | osv/GHSA-27r3-jxmh-p828 |
homework-01/sasero/claude-monitor-usage/package-lock.json | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 | Dependencies (osv-scanner) |
| high | opengrep/dockerfile.security.missing-user |
homework-01/sasero/office-chaos/server/Dockerfile:18 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | osv/GHSA-59g5-xgcq-4qw3 |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1851, GHSA-59g5-xgcq-4qw3 | Dependencies (osv-scanner) |
| high | osv/GHSA-5rvq-cxj2-64vf |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3036, GHSA-5rvq-cxj2-64vf | Dependencies (osv-scanner) |
| high | osv/GHSA-pp6c-gr5w-3c5g |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3039, GHSA-pp6c-gr5w-3c5g | Dependencies (osv-scanner) |
| high | osv/GHSA-wp53-j4wj-2cfg |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-1852, GHSA-wp53-j4wj-2cfg | Dependencies (osv-scanner) |
| high | osv/GHSA-27r3-jxmh-p828 |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 | Dependencies (osv-scanner) |
| high | osv/GHSA-5jgf-p345-68v8 |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-5jgf-p345-68v8 | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-7p8r-x3mc-p8w7 |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7 | Dependencies (osv-scanner) |
| high | osv/GHSA-f65p-4m7j-42xc |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc | Dependencies (osv-scanner) |
| high | osv/GHSA-fph4-wmhf-6fwf |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-fph4-wmhf-6fwf | Dependencies (osv-scanner) |
| high | osv/GHSA-jqff-g426-hqxp |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-jqff-g426-hqxp | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qw65-cvwx-89v3 |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-v2hh-gcrm-f6hx |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-v2hh-gcrm-f6hx | Dependencies (osv-scanner) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-04/public/index.js:114 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-04/public/index.js:114 | User controlled data in a `modal.querySelector('.seller-id').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-04/public/index.js:115 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-04/public/index.js:115 | User controlled data in a `modal.querySelector('.seller-name').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-04/public/index.js:116 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-04/public/index.js:116 | User controlled data in a `modal.querySelector('.seller-domain').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
homework-04/public/index.js:118 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
homework-04/public/index.js:118 | User controlled data in a `modal.querySelector('.import-date').innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/button.tsx:39 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/card.tsx:14 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/card.tsx:23 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/card.tsx:33 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/card.tsx:43 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/card.tsx:51 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/input.tsx:11 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/input.tsx:22 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/input.tsx:37 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/diego-tomba/components/ui/misc.tsx:26 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
homework-01/diego-tomba/src/infrastructure/ai/claude-narrator.adapter.ts:166 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
homework-01/federico-liccione/src/app/admin/page.tsx:105 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
homework-01/federico-liccione/src/app/admin/page.tsx:82 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
homework-01/federico-liccione/src/app/page.tsx:16 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:100 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:106 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:43 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:45 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:47 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:55 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:59 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:64 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:66 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:68 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:92 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
homework-01/flavio/word_banks.py:95 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
homework-01/marioben/code-lens/.claude/skills/frontend-slides/scripts/extract-pptx.py:90 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
homework-01/mlucchesi/workbreak/modules/dashboard.py:348 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/lock_screen.py:444 | Is "is_on_break" a function or an attribute? If it is a function, you may have meant self.state.is_on_break() because self.state.is_on_break is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/lock_screen.py:895 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.state.is_meeting() because self.state.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/lock_screen.py:912 | Is "is_on_break" a function or an attribute? If it is a function, you may have meant self.state.is_on_break() because self.state.is_on_break is always true. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
homework-01/mlucchesi/workbreak/modules/state.py:112 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/state.py:155 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.is_meeting() because self.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
homework-01/mlucchesi/workbreak/modules/state.py:44 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/state.py:61 | Is "is_working" a function or an attribute? If it is a function, you may have meant self.is_working() because self.is_working is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/state.py:62 | Is "is_on_break" a function or an attribute? If it is a function, you may have meant self.is_on_break() because self.is_on_break is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/state.py:63 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.is_meeting() because self.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
homework-01/mlucchesi/workbreak/modules/state.py:78 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/timer_engine.py:210 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.state.is_meeting() because self.state.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/tray.py:56 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.state.is_meeting() because self.state.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/tray.py:56 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.state.is_meeting() because self.state.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/tray.py:57 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.state.is_meeting() because self.state.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/tray.py:58 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.state.is_meeting() because self.state.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/mlucchesi/workbreak/modules/tray.py:71 | Is "is_meeting" a function or an attribute? If it is a function, you may have meant self.state.is_meeting() because self.state.is_meeting is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/api/routes.py:118 | Is "is_read" a function or an attribute? If it is a function, you may have meant finding.read_state.is_read() because finding.read_state.is_read is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/api/routes.py:134 | Is "is_read" a function or an attribute? If it is a function, you may have meant body.is_read() because body.is_read is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/db/repositories.py:109 | Is "is_current" a function or an attribute? If it is a function, you may have meant Digest.is_current() because Digest.is_current is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/db/repositories.py:126 | Is "is_read" a function or an attribute? If it is a function, you may have meant rs.is_read() because rs.is_read is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/db/repositories.py:206 | Is "is_current" a function or an attribute? If it is a function, you may have meant Digest.is_current() because Digest.is_current is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/db/repositories.py:28 | Is "is_read" a function or an attribute? If it is a function, you may have meant ReadState.is_read() because ReadState.is_read is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/db/repositories.py:73 | Is "is_current" a function or an attribute? If it is a function, you may have meant Digest.is_current() because Digest.is_current is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/rosario/gatherer/backend/app/db/repositories.py:78 | Is "is_read" a function or an attribute? If it is a function, you may have meant ReadState.is_read() because ReadState.is_read is always true. | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
homework-01/rosario/gatherer/frontend/src/components/Sidebar.tsx:71 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
homework-01/sasero/office-chaos/client/src/hud/OnboardingModal.jsx:6 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/dependencies/auth.py:39 | Is "is_active" a function or an attribute? If it is a function, you may have meant user.is_active() because user.is_active is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/appointments.py:114 | Is "is_available" a function or an attribute? If it is a function, you may have meant slot.is_available() because slot.is_available is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/appointments.py:218 | Is "is_available" a function or an attribute? If it is a function, you may have meant slot.is_available() because slot.is_available is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/appointments.py:94 | Is "is_available" a function or an attribute? If it is a function, you may have meant slot.is_available() because slot.is_available is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/auth.py:54 | Is "is_active" a function or an attribute? If it is a function, you may have meant user.is_active() because user.is_active is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/auth.py:98 | Is "is_active" a function or an attribute? If it is a function, you may have meant user.is_active() because user.is_active is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/doctors.py:57 | Is "is_active" a function or an attribute? If it is a function, you may have meant User.is_active() because User.is_active is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/doctors.py:87 | Is "is_available" a function or an attribute? If it is a function, you may have meant Slot.is_available() because Slot.is_available is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
homework-01/tommasoNocchi/backend/app/routers/slots.py:50 | Is "is_available" a function or an attribute? If it is a function, you may have meant Slot.is_available() because Slot.is_available is always true. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/badge.tsx:25 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/button.tsx:36 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/card.tsx:10 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/card.tsx:15 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/card.tsx:20 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/card.tsx:25 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/card.tsx:30 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/card.tsx:5 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/dialog.tsx:18 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/dialog.tsx:35 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/dialog.tsx:48 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/dialog.tsx:53 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/dialog.tsx:61 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/dialog.tsx:69 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/input.tsx:15 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/label.tsx:12 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/select.tsx:20 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/select.tsx:43 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/select.tsx:63 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/select.tsx:79 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/select.tsx:87 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/tabs.tsx:14 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/tabs.tsx:29 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/tabs.tsx:41 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/components/ui/textarea.tsx:14 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/LoginPage.tsx:62 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/LoginPage.tsx:67 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:170 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:175 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:181 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:186 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:191 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:196 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:214 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:219 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:225 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:230 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:235 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:240 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:257 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:272 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:276 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:306 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:310 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
homework-01/tommasoNocchi/frontend/src/pages/auth/RegisterPage.tsx:314 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | osv/GHSA-337j-9hxr-rhxg |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-337j-9hxr-rhxg; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-4w7w-66w2-5vf9 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-67mh-4wv8-2f99 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-67mh-4wv8-2f99; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-fx2h-pf6j-xcff |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-fxqj-rqcc-2cmp |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in homework-01/diego-tomba/package-lock.json; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in... | Dependencies (osv-scanner) |
| medium | osv/GHSA-jjmj-jmhj-qwj2 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-jjmj-jmhj-qwj2; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-v6wh-96g9-6wx3 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3; also in homework-01/federico-liccione/package-lock.json; also in homework-01/gabriM/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv; also in homework-01/gabriM/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-wrjc-x8rr-h8h6 |
homework-01/dario-triolo/package-lock.json | [email protected] (npm) is affected by GHSA-wrjc-x8rr-h8h6; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-4633-3j49-mh5q |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-4633-3j49-mh5q | Dependencies (osv-scanner) |
| medium | osv/GHSA-4c39-4ccg-62r3 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-4c39-4ccg-62r3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4jqv-mc3x-m676 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-4jqv-mc3x-m676 | Dependencies (osv-scanner) |
| medium | osv/GHSA-68g3-v927-f742 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-68g3-v927-f742 | Dependencies (osv-scanner) |
| medium | osv/GHSA-955p-x3mx-jcvp |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-955p-x3mx-jcvp | Dependencies (osv-scanner) |
| medium | osv/GHSA-fxqj-rqcc-2cmp |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-mcj8-r9mp-w47p |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-mcj8-r9mp-w47p | Dependencies (osv-scanner) |
| medium | osv/GHSA-q8wf-6r8g-63ch |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-q8wf-6r8g-63ch | Dependencies (osv-scanner) |
| medium | osv/GHSA-qx2v-qp2m-jg93 |
homework-01/diego-tomba/package-lock.json | [email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
homework-01/ema/gitdash/main.js:34 | Detected that function argument `folderPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
homework-01/ema/gitdash/main.js:38 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
homework-01/ema/gitdash/main.js:38 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
homework-01/ema/gitdash/main.js:39 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
homework-01/ema/gitdash/main.js:40 | Detected that function argument `folderPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | osv/GHSA-2jfj-6hjv-fm6j |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-2jfj-6hjv-fm6j; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-2p8c-gr87-2676 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-2p8c-gr87-2676; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-3xpg-4rpp-hhhm |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-3xpg-4rpp-hhhm; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-55wc-3pg8-jfw6 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-8xcm-r25x-g524 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-8xcm-r25x-g524; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-997q-gvvc-jwmx |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-997q-gvvc-jwmx; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-f72v-6w45-q472 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-f72v-6w45-q472; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-fw47-9c62-h3vw |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-fw47-9c62-h3vw; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-jr45-8vmc-qm54 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-jr45-8vmc-qm54; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-m8rv-5g2x-5cg5 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-p88m-4jfj-68fv |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-p88m-4jfj-68fv; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-pmjh-fq2x-6v4x |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-pmjh-fq2x-6v4x; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-pr7r-676h-xcf6 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-pr7r-676h-xcf6; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-r4w5-6pfg-jxp5 |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-r4w5-6pfg-jxp5; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-rx4f-c7p8-82vq |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-rx4f-c7p8-82vq; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-v3r7-h72x-cjcm |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm; also in homework-01/federico-liccione/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-x562-297c-g43g |
homework-01/ema/gitdash/package-lock.json | [email protected] (npm) is affected by GHSA-x562-297c-g43g; also in homework-01/ema/nerd-quest/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-2jfj-6hjv-fm6j |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-2jfj-6hjv-fm6j | Dependencies (osv-scanner) |
| medium | osv/GHSA-3wwx-pv8p-q78v |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-3wwx-pv8p-q78v | Dependencies (osv-scanner) |
| medium | osv/GHSA-3xpg-4rpp-hhhm |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-3xpg-4rpp-hhhm | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-55wc-3pg8-jfw6 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8xcm-r25x-g524 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-8xcm-r25x-g524 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-f72v-6w45-q472 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-f72v-6w45-q472 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jr45-8vmc-qm54 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-jr45-8vmc-qm54 | Dependencies (osv-scanner) |
| medium | osv/GHSA-m8rv-5g2x-5cg5 |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-pmjh-fq2x-6v4x |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-pmjh-fq2x-6v4x | Dependencies (osv-scanner) |
| medium | osv/GHSA-rx4f-c7p8-82vq |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-rx4f-c7p8-82vq | Dependencies (osv-scanner) |
| medium | osv/GHSA-v3r7-h72x-cjcm |
homework-01/ema/nerd-quest/package-lock.json | [email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm | Dependencies (osv-scanner) |
| medium | osv/GHSA-22jq-vg5j-6vgg |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-22jq-vg5j-6vgg | Dependencies (osv-scanner) |
| medium | osv/GHSA-2vr4-cq9g-pvrc |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-2vr4-cq9g-pvrc | Dependencies (osv-scanner) |
| medium | osv/GHSA-39m8-27wv-hr27 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-39m8-27wv-hr27 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3x4c-7xq6-9pq8 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-3x4c-7xq6-9pq8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4633-3j49-mh5q |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4633-3j49-mh5q | Dependencies (osv-scanner) |
| medium | osv/GHSA-46wx-v44x-9hh2 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-46wx-v44x-9hh2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4c39-4ccg-62r3 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4c39-4ccg-62r3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4ffr-jq9g-5ffx |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4ffr-jq9g-5ffx | Dependencies (osv-scanner) |
| medium | osv/GHSA-4g23-2xm8-66gc |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4g23-2xm8-66gc | Dependencies (osv-scanner) |
| medium | osv/GHSA-4h7h-rv7c-7m2v |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4h7h-rv7c-7m2v | Dependencies (osv-scanner) |
| medium | osv/GHSA-4m76-xfj5-7975 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4m76-xfj5-7975 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4mjr-xmp4-gh2g |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g; also in homework-01/sasero/claude-monitor-usage/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-4xrf-jv44-h6hh |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-4xrf-jv44-h6hh | Dependencies (osv-scanner) |
| medium | osv/GHSA-54fx-42gc-7vw4 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-54fx-42gc-7vw4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-5r4p-p66f-jhc7 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-5r4p-p66f-jhc7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-68g3-v927-f742 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-68g3-v927-f742 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6pq8-jhm2-2vcw |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw; also in homework-01/sasero/claude-monitor-usage/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-6prh-2h8m-c8cw |
homework-01/federico-liccione/package-lock.json | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-6prh-2h8m-c8cw | Dependencies (osv-scanner) |
| medium | osv/GHSA-6vj9-mwq6-2f5v |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-6vj9-mwq6-2f5v | Dependencies (osv-scanner) |
| medium | osv/GHSA-85x2-q946-cp5h |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-85x2-q946-cp5h | Dependencies (osv-scanner) |
| medium | osv/GHSA-8c8m-p3m8-cjg8 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-8c8m-p3m8-cjg8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8j4g-w8fx-2239 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-8j4g-w8fx-2239 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8m3c-c648-2xjj |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-8m3c-c648-2xjj | Dependencies (osv-scanner) |
| medium | osv/GHSA-8vvx-rff5-p5rq |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-8vvx-rff5-p5rq | Dependencies (osv-scanner) |
| medium | osv/GHSA-955p-x3mx-jcvp |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-955p-x3mx-jcvp | Dependencies (osv-scanner) |
| medium | osv/GHSA-9g9p-9gw9-jx7f |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-9g9p-9gw9-jx7f | Dependencies (osv-scanner) |
| medium | osv/GHSA-cc9r-2j5m-2m83 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-cc9r-2j5m-2m83 | Dependencies (osv-scanner) |
| medium | osv/GHSA-crvj-82cr-hjcx |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-crvj-82cr-hjcx | Dependencies (osv-scanner) |
| medium | osv/GHSA-f23p-vx2j-j53r |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-f23p-vx2j-j53r | Dependencies (osv-scanner) |
| medium | osv/GHSA-ffhc-5mcf-pf4q |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-ffhc-5mcf-pf4q | Dependencies (osv-scanner) |
| medium | osv/GHSA-frvp-7c67-39w9 |
homework-01/federico-liccione/package-lock.json | @hono/[email protected] (npm) is affected by GHSA-frvp-7c67-39w9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-g6gw-c38x-mqfc |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-g6gw-c38x-mqfc | Dependencies (osv-scanner) |
| medium | osv/GHSA-g73g-hqqh-jr95 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-g73g-hqqh-jr95 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gcqx-w48m-w2h4 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-ggv3-7p47-pfv8 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-ggv3-7p47-pfv8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gqvv-2mrq-wpjv |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-gqvv-2mrq-wpjv | Dependencies (osv-scanner) |
| medium | osv/GHSA-gx5p-jg67-6x7h |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-gx5p-jg67-6x7h | Dependencies (osv-scanner) |
| medium | osv/GHSA-h3mg-xc3c-68pw |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw | Dependencies (osv-scanner) |
| medium | osv/GHSA-h64f-5h5j-jqjh |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-h64f-5h5j-jqjh | Dependencies (osv-scanner) |
| medium | osv/GHSA-h7mg-cq63-vhpq |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-h7mg-cq63-vhpq | Dependencies (osv-scanner) |
| medium | osv/GHSA-hrr3-gc8f-f4qj |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj | Dependencies (osv-scanner) |
| medium | osv/GHSA-hvrm-45r6-mjfj |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-hvrm-45r6-mjfj | Dependencies (osv-scanner) |
| medium | osv/GHSA-hxh3-vqpv-xpqv |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-hxh3-vqpv-xpqv | Dependencies (osv-scanner) |
| medium | osv/GHSA-j6r3-76f7-8jcv |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-jpvv-r467-5p4w |
homework-01/federico-liccione/package-lock.json | @hono/[email protected] (npm) is affected by GHSA-jpvv-r467-5p4w | Dependencies (osv-scanner) |
| medium | osv/GHSA-m943-m63m-w62w |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-m943-m63m-w62w | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in homework-01/marioben/code-lens/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-rj75-hqrm-r3gf |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-rj75-hqrm-r3gf | Dependencies (osv-scanner) |
| medium | osv/GHSA-rmxm-3fg6-px4f |
homework-01/federico-liccione/package-lock.json | @hono/[email protected] (npm) is affected by GHSA-rmxm-3fg6-px4f | Dependencies (osv-scanner) |
| medium | osv/GHSA-rpw4-54j3-4h4q |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-rpw4-54j3-4h4q | Dependencies (osv-scanner) |
| medium | osv/GHSA-rvq5-wwqv-78pq |
homework-01/federico-liccione/package-lock.json | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-rvq5-wwqv-78pq | Dependencies (osv-scanner) |
| medium | osv/GHSA-rxp7-6hxx-x8q5 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv; also in homework-01/marioben/code-lens/frontend/package-lock.json; also in homework-01/rosario/gatherer/frontend/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-w62v-xxxg-mg59 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-w62v-xxxg-mg59 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w74x-v6f9-j3xg |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wfc6-r584-vfw7 |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-wfc6-r584-vfw7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-wmmp-3585-3rmp |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-wmmp-3585-3rmp | Dependencies (osv-scanner) |
| medium | osv/GHSA-x5fp-wj9c-mxmx |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-x5fp-wj9c-mxmx; also in homework-01/sasero/claude-monitor-usage/package-lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-xgm2-5f3f-mvvc |
homework-01/federico-liccione/package-lock.json | [email protected] (npm) is affected by GHSA-xgm2-5f3f-mvvc | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/federico-liccione/src/app/api/feed/route.ts:33 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/federico-liccione/src/app/api/feed/route.ts:39 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/federico-liccione/src/app/api/notify/route.ts:98 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/federico-liccione/src/components/EventMap.tsx:134 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/federico-liccione/src/components/EventMap.tsx:137 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/federico-liccione/src/components/EventMap.tsx:152 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/federico-liccione/src/components/EventMap.tsx:179 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | osv/GHSA-7p48-42j8-8846 |
homework-01/flavio/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2285, GHSA-7p48-42j8-8846 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rxff-vr5r-8cj5 |
homework-01/flavio/requirements.txt | [email protected] (PyPI) is affected by GHSA-rxff-vr5r-8cj5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vqwp-45wm-r9r5 |
homework-01/flavio/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-212, GHSA-vqwp-45wm-r9r5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mf9w-mj56-hr94 |
homework-01/gabriM/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2270, GHSA-mf9w-mj56-hr94 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/gabriM/frontend/src/App.jsx:16 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/gabriM/frontend/src/App.jsx:17 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/gabriM/frontend/src/App.jsx:18 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/gabriM/frontend/src/App.jsx:19 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/gabriM/frontend/src/App.jsx:21 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.net.use-tls |
homework-01/gabriV/cmd/server/main.go:37 | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used |
homework-01/gabriV/internal/game/state.go:5 | Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.gorilla.security.audit.websocket-missing-origin-check |
homework-01/gabriV/internal/room/client.go:49 | The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per... | Static analysis (opengrep) |
| medium | opengrep/go.gorilla.security.audit.websocket-missing-origin-check |
homework-01/gabriV/internal/room/client.go:68 | The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/gabriV/web/js/hud.js:103 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/gabriV/web/js/hud.js:104 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | osv/GHSA-698v-4r3x-3vcv |
homework-01/marioben/code-lens/frontend/package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
homework-01/marioben/code-lens/frontend/package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
homework-01/marioben/code-lens/frontend/package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/matteo/space-invaders/game.js:318 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | osv/GHSA-24rc-8hj2-v98c |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c | Dependencies (osv-scanner) |
| medium | osv/GHSA-254f-3936-288h |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-254f-3936-288h | Dependencies (osv-scanner) |
| medium | osv/GHSA-462x-pgg6-55fp |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp | Dependencies (osv-scanner) |
| medium | osv/GHSA-4rm8-3hmm-39fg |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg | Dependencies (osv-scanner) |
| medium | osv/GHSA-4x4j-2g7c-83w6 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-74r2-7ff9-mjj2 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc9g-5qg7-mf45 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fj7v-r99m-22gq |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq | Dependencies (osv-scanner) |
| medium | osv/GHSA-p8hx-v2p6-rp84 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r73j-pqj5-w3x7 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rfgq-q3w2-pmv2 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vx6w-vv9f-6gvg |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjx4-4jcj-g98j |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j | Dependencies (osv-scanner) |
| medium | osv/GHSA-wqgw-9xfh-qf2g |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g | Dependencies (osv-scanner) |
| medium | osv/PYSEC-2023-175 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2023-175 | Dependencies (osv-scanner) |
| medium | osv/PYSEC-2023-183 |
homework-01/mlucchesi/workbreak/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2023-183 | Dependencies (osv-scanner) |
| medium | opengrep/python.fastapi.security.wildcard-cors |
homework-01/rosario/gatherer/backend/app/main.py:41 | CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
homework-01/sasero/claude-monitor-usage/server.js:138 | Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
homework-01/sasero/claude-monitor-usage/server.js:326 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | osv/GHSA-cjwg-qfpm-7377 |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2024-233, GHSA-cjwg-qfpm-7377 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mj87-hwqh-73pj |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2026-3038, GHSA-mj87-hwqh-73pj | Dependencies (osv-scanner) |
| medium | osv/PYSEC-2025-185 |
homework-01/tommasoNocchi/backend/requirements.txt | [email protected] (PyPI) is affected by PYSEC-2025-185 | Dependencies (osv-scanner) |
| medium | opengrep/dockerfile.security.secret-in-build-arg |
homework-01/tommasoNocchi/frontend/Dockerfile:6 | Docker build time arguments are not suited for secrets, because the argument values are saved with the image. Running `docker image history` on the image will show information on how the image was built, including arguments. If these... | Static analysis (opengrep) |
| medium | osv/GHSA-4mjr-xmp4-gh2g |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g | Dependencies (osv-scanner) |
| medium | osv/GHSA-6pq8-jhm2-2vcw |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw | Dependencies (osv-scanner) |
| medium | osv/GHSA-hrr3-gc8f-f4qj |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-w74x-v6f9-j3xg |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjr9-j795-jxcr |
homework-04/package-lock.json | [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr | Dependencies (osv-scanner) |
| medium | opengrep/javascript.express.security.audit.xss.ejs.template-explicit-unescape |
homework-04/views/index.ejs:11 | Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you... | Static analysis (opengrep) |
| medium | opengrep/javascript.express.security.audit.xss.ejs.var-in-script-tag |
homework-04/views/index.ejs:11 | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the... | Static analysis (opengrep) |
| medium | opengrep/javascript.express.security.audit.xss.ejs.template-explicit-unescape |
homework-04/views/index.ejs:12 | Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you... | Static analysis (opengrep) |
| medium | opengrep/javascript.express.security.audit.xss.ejs.var-in-script-tag |
homework-04/views/index.ejs:12 | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
homework-01/diego-tomba/src/infrastructure/github/octokit-git-platform.adapter.ts:190 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
homework-01/tommasoNocchi/frontend/src/pages/patient/BookVisitPage.tsx:77 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
homework-01/tommasoNocchi/frontend/src/pages/patient/BookVisitPage.tsx:77 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
homework-01/diego-tomba/src/presentation/cli/index.ts:38 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
homework-01/diego-tomba/worker/scheduler.ts:60 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
homework-01/federico-liccione/src/lib/scrapers/centrisociali.ts:98 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
homework-01/federico-liccione/src/lib/scrapers/telegram.ts:125 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
homework-01/marioben/code-lens/.claude/skills/api-design/SKILL.md:307 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | opengrep/javascript.express.security.audit.express-check-csurf-middleware-usage |
homework-01/sasero/claude-monitor-usage/server.js:9 | A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.... | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 118 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | skipped | — | 0 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 300 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 59 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | dacbc75ca1a8 | prov-5+qual-2+sec-2 | 21% | 54 | 53 |
| 2026-11-14 | dacbc75ca1a8 | prov-4+qual-2+sec-2 | 21% | 54 | 53 |
Full text report
- Repository: https://github.com/l-baglini/signal42-training-repository
- Commit:
dacbc75ca1a8c9c22f824a05ada09a2b76ca2018 - Generated: 2026-11-14T14:52:05+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 21 | explicit | 81% | 100% |
| Code quality | 54 | weak | 90% | 100% |
| Security | 53 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 21% of first-party code added; an estimated 21% including velocity signals.
- Explicitly attributed share (lower bound): 20.9%
- Unattributed share in AI-consistent velocity bursts: 26.3%
- Estimated AI-generated share: 20.9%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 7 | 10,996 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 10,891 of 43,353.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.102 | 3.265 | 0.34x |
| Security | 0.184 | 1.54 | 0.12x |
- Stylometry index: 3.08 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 267). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-06 | 52,021 | 21% |
| 2026-07 | 585 | 8% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (a77181a07445)
- Claude Code: trailer 'Co-Authored-By: Claude' (31a4a9b2b1fc)
- Claude Code: trailer 'Co-Authored-By: Claude' (f0d21ac57d8f)
- Claude Code: trailer 'Co-Authored-By: Claude' (a258e07d7d72)
- Claude Code: trailer 'Co-authored-by: Claude' (e518a31924d9)
- Claude Code: trailer 'Co-Authored-By: Claude' (95626686af4d)
- Claude Code: trailer 'Co-authored-by: Claude' (6001399fecf2)
- homework-01/dario-triolo/CLAUDE.md (claude-code configuration) (homework-01/)
- homework-01/f-pettrone/maze-cli-escape/CLAUDE.md (claude-code configuration) (homework-01/)
- homework-01/federico-liccione/CLAUDE.md (claude-code configuration) (homework-01/)
- homework-01/federico-quaglia/CLAUDE.md (claude-code configuration) (homework-01/)
- homework-01/gabriV/CLAUDE.md (claude-code configuration) (homework-01/)
- homework-01/marioben/code-lens/CLAUDE.md (claude-code configuration) (homework-01/)
- homework-01/mdand/CLAUDE.md (claude-code configuration) (homework-01/)
- homework-01/michele_bertagni/CLAUDE.md (claude-code configuration) (homework-01/)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.03, no CI test run detected; 12% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 70 |
| Duplication | 87 |
| Code smells (Opengrep) | 46 |
| Tests and CI | 29 |
| Documentation | 40 |
| Type safety | 76 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,304; mean complexity 2.6, 90th percentile 6; 21 complex and 14 long functions
- Duplicated lines: 2.4% of 31,421 compared
- Tests: 1,418 test lines for 43,353 source lines (ratio 0.03); CI test commands: none detected; 19% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Most complex functions:
- runPipeline in homework-01/federico-liccione/src/lib/pipeline.ts: complexity 44, 102 lines
- _loop in homework-01/sasero/office-chaos/client/src/game/three/Scene.js: complexity 36, 77 lines
- makeFurniture in homework-01/sasero/office-chaos/client/src/game/three/catalog.js: complexity 31, 137 lines
- simTick in homework-01/sasero/office-chaos/server/src/game/rooms.js: complexity 29, 44 lines
- validateLayout in homework-01/sasero/office-chaos/server/src/game/map.js: complexity 27, 29 lines
Security
Security posture is weak: 328 known vulnerabilities in 53 dependencies; 22 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 78 |
| Vulnerable dependencies (OSV) | 0 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 328 in 53 packages (critical 19, high 135, medium 144, low 27)
-
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-2464-fhr4-w9xw: [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw |
homework-01/diego-tomba/package-lock.json |
| critical | osv/GHSA-2xp9-vwfh-vxw4: [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4 |
homework-01/diego-tomba/package-lock.json |
| critical | osv/GHSA-p293-qw3h-jr36: [email protected] (npm) is affected by GHSA-p293-qw3h-jr36 |
homework-01/diego-tomba/package-lock.json |
| critical | osv/GHSA-v5rq-49vh-5v5c: @simple-git/[email protected] (npm) is affected by GHSA-v5rq-49vh-5v5c |
homework-01/ema/gitdash/package-lock.json |
| critical | osv/GHSA-x6jw-m9v5-85vh: [email protected] (npm) is affected by GHSA-x6jw-m9v5-85vh |
homework-01/ema/gitdash/package-lock.json |
| critical | osv/GHSA-2464-fhr4-w9xw: [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw |
homework-01/federico-liccione/package-lock.json |
| critical | osv/GHSA-2xp9-vwfh-vxw4: [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4 |
homework-01/federico-liccione/package-lock.json |
| critical | osv/GHSA-p293-qw3h-jr36: [email protected] (npm) is affected by GHSA-p293-qw3h-jr36 |
homework-01/federico-liccione/package-lock.json |
| critical | osv/GHSA-jqcg-44mw-7w3h: [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h; also in homework-01/sasero/claude-monitor-usage/package-lock.json; also in homework-04/package-lock.json |
homework-01/federico-liccione/package-lock.json |
| critical | osv/GHSA-5gmw-xhrv-c9v3: [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 |
homework-01/federico-liccione/package-lock.json |
| critical | osv/GHSA-85c8-ppgw-ccpr: [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr |
homework-01/federico-liccione/package-lock.json |
| critical | osv/GHSA-5xrq-8626-4rwp: [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp |
homework-01/federico-liccione/package-lock.json |
| critical | osv/GHSA-5x8w-8jj5-q52h: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
homework-01/mlucchesi/workbreak/requirements.txt |
| critical | osv/GHSA-8g5g-8vmr-9782: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
homework-01/mlucchesi/workbreak/requirements.txt |
| critical | osv/GHSA-xvh5-g6gv-559v: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
homework-01/mlucchesi/workbreak/requirements.txt |
| critical | osv/GHSA-3f63-hfp8-52jq: [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq |
homework-01/mlucchesi/workbreak/requirements.txt |
| critical | osv/GHSA-332p-7hrc-92wf: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf |
homework-01/mlucchesi/workbreak/requirements.txt |
| critical | osv/GHSA-w889-685w-c8fh: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh |
homework-01/mlucchesi/workbreak/requirements.txt |
| critical | osv/GHSA-3qf3-8w2g-rqmx: [email protected] (PyPI) is affected by PYSEC-2024-232, PYSEC-2026-4298, GHSA-3qf3-8w2g-rqmx, GHSA-6c5p-j8vq-pqhj |
homework-01/tommasoNocchi/backend/requirements.txt |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
homework-01/federico-quaglia/analyzer.py:225 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
homework-01/gabriV/web/js/hud.js:102 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a line.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
homework-01/gabriV/web/js/hud.js:102 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
homework-01/gabriV/web/js/lobby.js:11 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a container.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
homework-01/gabriV/web/js/lobby.js:11 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
homework-01/gabriV/web/js/options.js:12 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 43,353; test lines: 1,418
| Language | Lines |
|---|---|
| JavaScript | 16,272 |
| TypeScript | 14,789 |
| Python | 9,856 |
| Go | 1,488 |
| Dart | 894 |
| Shell | 654 |
| SQL | 556 |
| Java | 262 |