Leaderboard github.com
prosperity-solutions/veld
Like if Kubernetes and localhost had a magic, agentic baby — with a gorgeous UI.
AI provenance
24%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
79/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
51/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
24% explicit
Explicit AI attribution on 24% of first-party code added; an estimated 24% including velocity signals.
How the score is built
- Explicitly attributed share24%
- Unattributed share in AI-pace bursts41%
- Estimated AI-generated share24%
- AI tool configuration files7
- Work sessions at AI pace70
- Releases at AI pace1
- Coding-style index (1.0+ means possible)0.17
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 286 | 94,297 | 2026-03-11 | 2026-11-05 |
Lines added per month all AI-attributed share
- 2026-0357,731 · 79% AI
- 2026-0538 · 0% AI
- 2026-06884 · 100% AI
- 2026-0781,263 · 5% AI
- 2026-08142,502 · 0% AI
- 2026-0944,639 · 33% AI
- 2026-1047,734 · 42% AI
- 2026-1110,239 · 86% AI
Findings in AI-attributed lines vs the rest
From git blame: 47,629 lines trace to AI-attributed commits, 221,854 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.38 | 0.34 | 1.10× |
| Security | 0.44 | 0.65 | 0.67× |
Evidence by analyzer
Explicit AI attributionok26 items
- Claude Code: 286 attributed commits, 94,297 lines added
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- attributed_commit_share
- 39.8%
- attributed_commits
- 286
- attributed_loc
- 94,297
- attributed_loc_share
- 24.5%
- commits
- 718
- effective_loc
- 385,030
- tools_detected
- 1
AI tool configurationok7 items
- .claude/settings.json (claude-code configuration)
- .claude/skills/ship (claude-code configuration)
- .claude/skills/veld (claude-code configuration)
- CLAUDE.md (claude-code configuration)
- AGENTS.md (generic-agent configuration)
- website/AGENTS.md (generic-agent configuration)
- .gemini/settings.json (gemini configuration)
- artifacts
- 7
- earliest_adoption
- 2026-03-13
- tools_configured
- 3
- workflow_agents
- 0
Commit velocityok15 items
- 5,636 lines of first-party code in ~0.5h (11,272 lines/hour, PR #250)
- 5,561 lines of first-party code in ~0.5h (11,122 lines/hour, PR #198)
- 5,207 lines of first-party code in ~0.5h (10,414 lines/hour, PR #311)
- 3,425 lines of first-party code in ~0.5h (6,850 lines/hour, PR #330)
- 3,314 lines of first-party code in ~0.5h (6,628 lines/hour, PR #220)
- 3,215 lines of first-party code in ~0.5h (6,430 lines/hour, PR #308)
- 5,955 lines of first-party code in ~1.0h (5,799 lines/hour, PR #279)
- 2,852 lines of first-party code in ~0.5h (5,704 lines/hour, PR #245)
- 2,741 lines of first-party code in ~0.5h (5,482 lines/hour, PR #305)
- 2,396 lines of first-party code in ~0.5h (4,792 lines/hour, PR #285)
- 2,378 lines of first-party code in ~0.5h (4,756 lines/hour, PR #225)
- 2,289 lines of first-party code in ~0.5h (4,578 lines/hour, PR #304)
- 2,255 lines of first-party code in ~0.5h (4,510 lines/hour, PR #324)
- 4,479 lines of first-party code in ~1.0h (4,486 lines/hour, PR #175)
- 2,009 lines of first-party code in ~0.5h (4,018 lines/hour, PR #323)
- excluded_import_loc
- 42,061
- flagged_loc
- 190,135
- flagged_loc_share
- 55.4%
- flagged_units
- 70
- max_loc_per_hour
- 11,272
- measured_loc
- 342,969
- median_loc_per_hour
- 377.35
- pr_timed_units
- 298
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 320
Release velocityok1 item
- flagged_releases
- 1
- max_loc_per_day
- 57,864
- releases
- 99
Coding styleok8 items
- step-by-step narration comment: * first, and from the one being watched on to the one after it, wrapping round.
- step-by-step narration comment: * first, in each backend, for the same reason: **the thing being resized owns the
- step-by-step narration comment: * first, forever.
- step-by-step narration comment: // First, and on every hostname: the one route Caddy
- step-by-step narration comment: // Step 1: Stop user-level helper if running.
- step-by-step narration comment: // Step 2: Check port availability.
- step-by-step narration comment: // Step 3: Install Caddy.
- step-by-step narration comment: // Step 4: Install Veld daemon.
- count:assistant_voice
- 0
- count:emoji_in_code
- 42
- count:narrated_steps
- 17
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 13
- files:narrated_steps
- 8
- files:placeholder
- 0
- index
- 0.17
- lines_scanned
- 226,564
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.18
- per_kloc:narrated_steps
- 0.07
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 47,629
- blame_failures
- 0
- files_blamed
- 363
- other_lines
- 221,854
- quality:ai_findings
- 18
- quality:ai_per_kloc
- 0.38
- quality:other_findings
- 76
- quality:other_per_kloc
- 0.34
- quality:ratio
- 1.10
- security:ai_findings
- 21
- security:ai_per_kloc
- 0.44
- security:other_findings
- 145
- security:other_per_kloc
- 0.65
- security:ratio
- 0.67
Code quality
79 adequate
Code quality is adequate: test-to-source ratio 0.13, CI runs tests; 23% of function code in complex or long functions; 2% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity51
- Duplication87
- Lint and smells95
- Tests and CI82
- Documentation80
- Type safety100
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- AppInner in crates/veld-daemon/ui/src/App.tsx: complexity 212, 1357 lines
- DatabaseHealthDialog in crates/veld-daemon/ui/src/components/dialogs.tsx: complexity 175, 1163 lines
- BrowserPane in crates/veld-daemon/ui/src/panes/BrowserPane.tsx: complexity 165, 1068 lines
- validate in crates/veld-core/src/db/settings.rs: complexity 128, 356 lines
- PaneChooser in crates/veld-daemon/ui/src/panes/PaneArea.tsx: complexity 100, 652 lines
- (anonymous) in crates/veld-daemon/ui/src/App.tsx: complexity 98, 219 lines
- renderGroup in crates/veld-daemon/ui/src/App.tsx: complexity 92, 246 lines
- as_str in crates/veld-core/src/db/settings.rs: complexity 85, 89 lines
- parse in crates/veld-core/src/db/settings.rs: complexity 85, 89 lines
- spec in crates/veld-core/src/db/settings_catalog.rs: complexity 85, 1129 lines
- complex_functions
- 198
- function_nloc
- 141,975
- functions
- 9,285
- long_functions
- 127
- many_param_functions
- 11
- mean_ccn
- 3.09
- p90_ccn
- 6
- risky_nloc_share
- 22.5%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: crates/veld-core/src/config.rs:542 and crates/veld-core/src/config.rs:901
- 6+ duplicated lines: crates/veld-core/src/db/backup.rs:1517 and crates/veld-core/src/db/backup.rs:2075
- 6+ duplicated lines: crates/veld-core/src/db/kv.rs:219 and crates/veld-core/src/db/kv.rs:250
- 6+ duplicated lines: crates/veld-core/src/db/layouts.rs:75 and crates/veld-core/src/db/layouts.rs:124
- 6+ duplicated lines: crates/veld-core/src/db/layouts.rs:225 and crates/veld-core/src/db/panes.rs:194
- 6+ duplicated lines: crates/veld-core/src/db/links.rs:857 and crates/veld-core/src/db/links.rs:1040
- 6+ duplicated lines: crates/veld-core/src/db/logs.rs:137 and crates/veld-core/src/db/logs.rs:191
- 6+ duplicated lines: crates/veld-core/src/db/mod.rs:1307 and crates/veld-core/src/db/mod.rs:1504
- 6+ duplicated lines: crates/veld-core/src/db/settings.rs:1287 and crates/veld-core/src/db/settings.rs:1580
- 6+ duplicated lines: crates/veld-core/src/db/settings_catalog.rs:517 and crates/veld-core/src/db/settings_catalog.rs:534
- compared_lines
- 210,344
- duplicated_lines
- 4,777
- duplicated_share
- 2.3%
- files
- 363
Lintok
- category:best-practice
- 48
- category:correctness
- 46
- findings
- 94
- scanned_lines
- 269,483
- weighted_findings
- 60.25
Tests and CIok6 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/lock.yml
.github/workflows/lock.yml - CI config: .github/workflows/pages.yml
.github/workflows/pages.yml - CI config: .github/workflows/release.yml
.github/workflows/release.yml - CI runs tests (npm test, go test, cargo test, vitest)
- CI runs linters (biome, clippy, rustfmt, cargo fmt, shellcheck)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 4
- cochange_commits
- 164
- cochange_share
- 67.7%
- source_lines
- 269,483
- test_lines
- 35,704
- test_ratio
- 0.13
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 759
Type safetyok1 item
- TypeScript strict type checking: crates/veld-daemon/ui/tsconfig.json
crates/veld-daemon/ui/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 6
- escapes_per_kloc
- 0.09
Security
51 weak
Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 165 known vulnerabilities in 41 dependencies; 1 high-severity SAST findings; 1 high-severity workflow issues. Weakest area: dependencies.
How the score is built
- Secrets49
- Static analysis (SAST)95
- Vulnerable dependencies2
- CI workflows58
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 75
- declared
- 75
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 1
- secrets_history
- 0
- secrets_low_confidence
- 1
- secrets_nonprod
- 8
Static analysis (opengrep)ok
- findings
- 164
- findings_high
- 1
- findings_low
- 152
- findings_medium
- 11
- parse_errors
- 9
- scanned_lines
- 269,483
- weighted_findings
- 42.06
Dependencies (osv-scanner)ok
- penalty
- 254
- vulnerabilities
- 165
- vulnerable_packages
- 41
- vulns_critical
- 8
- vulns_high
- 73
- vulns_low
- 13
- vulns_medium
- 58
- vulns_unknown
- 13
CI workflows (zizmor)ok
- findings
- 26
- findings_high
- 1
- findings_low
- 4
- findings_medium
- 21
- penalty
- 32.40
- workflows
- 4
Security postureok10 items
- Dependency updates: renovate.json
renovate.json - crates/veld-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-core/Cargo.toml - crates/veld-daemon/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-daemon/Cargo.toml - crates/veld-engine/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-engine/Cargo.toml - crates/veld-gateway/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-gateway/Cargo.toml - crates/veld-helper/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-helper/Cargo.toml - crates/veld-share/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-share/Cargo.toml - crates/veld-sign/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-sign/Cargo.toml - crates/veld-stats/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld-stats/Cargo.toml - crates/veld/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/veld/Cargo.toml
- check:dependency_updates
- yes
- check:lockfiles
- no
- check:security_policy
- no
- check:signed_commits
- yes
- signed_commit_share
- 60.0%
- unpinned_manifests
- 9
Release downloadsok6 items
- release v17.10.0 ships veld-17.10.0-linux-amd64.tar.gz (2 downloads)
- release v17.10.0 ships veld-17.10.0-linux-arm64.tar.gz (1 downloads)
- release v17.10.0 ships veld-17.10.0-macos-amd64.tar.gz (2 downloads)
- release v17.10.0 ships veld-17.10.0-macos-arm64.tar.gz (8 downloads)
- release v17.10.0 ships veld-desktop-17.10.0-linux-amd64.deb (1 downloads)
- gives an archive password
README.md
- binary_assets
- 140
- signals
- 2
- suspicious
- 0
Findings
8 critical76 high152 medium219 low4 info
459 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-5gmw-xhrv-c9v3 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 | Dependencies (osv-scanner) |
| critical | osv/GHSA-85c8-ppgw-ccpr |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr | Dependencies (osv-scanner) |
| critical | osv/GHSA-cg2g-xh64-v4q7 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 | Dependencies (osv-scanner) |
| critical | osv/GHSA-2464-fhr4-w9xw |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw | Dependencies (osv-scanner) |
| critical | osv/GHSA-2xp9-vwfh-vxw4 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4 | Dependencies (osv-scanner) |
| critical | osv/GHSA-673q-mjm6-r5xr |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-673q-mjm6-r5xr | Dependencies (osv-scanner) |
| critical | osv/GHSA-p293-qw3h-jr36 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-p293-qw3h-jr36 | Dependencies (osv-scanner) |
| critical | osv/GHSA-vcvr-r3jv-pc5j |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-vcvr-r3jv-pc5j | Dependencies (osv-scanner) |
| high | zizmor/dangerous-triggers |
.github/workflows/lock.yml:13 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | osv/RUSTSEC-2026-0194 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0194 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0195 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0195 | Dependencies (osv-scanner) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
crates/veld-daemon/src/pty.rs:7931 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | osv/GHSA-2m5v-pch6-74hx |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-2v37-7h3g-55p8 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 | Dependencies (osv-scanner) |
| high | osv/GHSA-4w7w-5xrc-9h26 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q; also in testproject-nextjs/package-lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-gfr2-rv44-r23c |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-gfr2-rv44-r23c | Dependencies (osv-scanner) |
| high | osv/GHSA-mrv2-3pqr-j5jr |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | gitleaks/private-key |
crates/veld-sign/src/main.rs:340 | Possible private-key secret in the current tree | Secrets (gitleaks) |
| high | osv/GHSA-27p8-2357-5qqv |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-27p8-2357-5qqv | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-4cwx-7wf7-3272 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-4cwx-7wf7-3272 | Dependencies (osv-scanner) |
| high | osv/GHSA-4w3w-2rp5-g8jm |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-4w3w-2rp5-g8jm | Dependencies (osv-scanner) |
| high | osv/GHSA-4w7w-5xrc-9h26 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 | Dependencies (osv-scanner) |
| high | osv/GHSA-5jgf-p345-68v8 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-5jgf-p345-68v8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-7p8r-x3mc-p8w7 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7 | Dependencies (osv-scanner) |
| high | osv/GHSA-8344-3jmq-59r6 |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-8344-3jmq-59r6 | Dependencies (osv-scanner) |
| high | osv/GHSA-93r5-fhx6-vmg9 |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-93r5-fhx6-vmg9 | Dependencies (osv-scanner) |
| high | osv/GHSA-965w-775f-mr7g |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-965w-775f-mr7g | Dependencies (osv-scanner) |
| high | osv/GHSA-9qh4-3jw8-366w |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-9qh4-3jw8-366w | Dependencies (osv-scanner) |
| high | osv/GHSA-c7q8-3ch8-vqpv |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-c7q8-3ch8-vqpv | Dependencies (osv-scanner) |
| high | osv/GHSA-f65p-4m7j-42xc |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc | Dependencies (osv-scanner) |
| high | osv/GHSA-fph4-wmhf-6fwf |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-fph4-wmhf-6fwf | Dependencies (osv-scanner) |
| high | osv/GHSA-gr2m-v5gq-v685 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-gr2m-v5gq-v685 | Dependencies (osv-scanner) |
| high | osv/GHSA-j84w-jfhq-vhvj |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-j84w-jfhq-vhvj | Dependencies (osv-scanner) |
| high | osv/GHSA-jqff-g426-hqxp |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-jqff-g426-hqxp | Dependencies (osv-scanner) |
| high | osv/GHSA-jr5w-w6x2-84p9 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-jr5w-w6x2-84p9 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qmv3-fv6v-rmhq |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-qmv3-fv6v-rmhq | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-qw65-cvwx-89v3 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 | Dependencies (osv-scanner) |
| high | osv/GHSA-rfgv-xxqx-mfg5 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5 | Dependencies (osv-scanner) |
| high | osv/GHSA-rfgv-xxqx-mfg5 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5 | Dependencies (osv-scanner) |
| high | osv/GHSA-w293-vg96-wgc3 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-w293-vg96-wgc3 | Dependencies (osv-scanner) |
| high | osv/GHSA-w2rr-34g9-rvrj |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-w2rr-34g9-rvrj | Dependencies (osv-scanner) |
| high | osv/GHSA-x4fp-j954-r2f4 |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-x4fp-j954-r2f4 | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | osv/GHSA-267c-6grr-h53f |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-267c-6grr-h53f | Dependencies (osv-scanner) |
| high | osv/GHSA-26hh-7cqf-hhc6 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-26hh-7cqf-hhc6 | Dependencies (osv-scanner) |
| high | osv/GHSA-28wg-ghj8-5hjv |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv | Dependencies (osv-scanner) |
| high | osv/GHSA-2v37-7h3g-55p8 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 | Dependencies (osv-scanner) |
| high | osv/GHSA-36qx-fr4f-26g5 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-36qx-fr4f-26g5 | Dependencies (osv-scanner) |
| high | osv/GHSA-492v-c6pp-mqqv |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-492v-c6pp-mqqv | Dependencies (osv-scanner) |
| high | osv/GHSA-6g55-p6wh-862q |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-6g55-p6wh-862q | Dependencies (osv-scanner) |
| high | osv/GHSA-6gpp-xcg3-4w24 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-6gpp-xcg3-4w24 | Dependencies (osv-scanner) |
| high | osv/GHSA-89xv-2m56-2m9x |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-89xv-2m56-2m9x | Dependencies (osv-scanner) |
| high | osv/GHSA-8h8q-6873-q5fj |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-8h8q-6873-q5fj | Dependencies (osv-scanner) |
| high | osv/GHSA-c4j6-fc7j-m34r |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-c4j6-fc7j-m34r | Dependencies (osv-scanner) |
| high | osv/GHSA-cjq9-62q9-8jv4 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-cjq9-62q9-8jv4 | Dependencies (osv-scanner) |
| high | osv/GHSA-f88m-g3jw-g9cj |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-f88m-g3jw-g9cj | Dependencies (osv-scanner) |
| high | osv/GHSA-m99w-x7hq-7vfj |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-m99w-x7hq-7vfj | Dependencies (osv-scanner) |
| high | osv/GHSA-mg66-mrh9-m8jx |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-mg66-mrh9-m8jx | Dependencies (osv-scanner) |
| high | osv/GHSA-p3m5-59mp-jv5r |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-p3m5-59mp-jv5r | Dependencies (osv-scanner) |
| high | osv/GHSA-p9j2-gv94-2wf4 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-p9j2-gv94-2wf4 | Dependencies (osv-scanner) |
| high | osv/GHSA-q4gf-8mx6-v5v3 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-q4gf-8mx6-v5v3 | Dependencies (osv-scanner) |
| high | osv/GHSA-r28c-9q8g-f849 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgj7-g3m4-5g8c |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-rgj7-g3m4-5g8c | Dependencies (osv-scanner) |
| high | osv/GHSA-wq5f-xc86-pv6w |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-wq5f-xc86-pv6w | Dependencies (osv-scanner) |
| high | osv/GHSA-xwg4-73v4-xw9w |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w | Dependencies (osv-scanner) |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/App.tsx:616 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/App.tsx:786 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/Extensions.tsx:333 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/Extensions.tsx:399 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:1533 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:1536 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:1542 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:196 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:453 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:455 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:458 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:471 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:477 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:484 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:494 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:500 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:502 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:953 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/SettingsDialog.tsx:977 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/StartConfig.tsx:234 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/StartConfig.tsx:235 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:1010 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:1077 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:1102 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:1123 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/dialogs.tsx:165 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/components/dialogs.tsx:2204 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:3196 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:3418 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:3419 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:3650 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/components/dialogs.tsx:998 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/outfit/useOutfitState.ts:49 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1384 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1399 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1413 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1432 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1466 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1484 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1684 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1847 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:1909 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:2395 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:2465 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-spreading |
crates/veld-daemon/ui/src/panes/BrowserPane.tsx:2486 | It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
crates/veld-daemon/ui/src/panes/devices.ts:1146 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/typescript.react.best-practice.react-props-in-state |
crates/veld-daemon/ui/src/shared/Sharing.tsx:426 | Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
desktop/src/main.js:219 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
desktop/src/main.js:220 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:108 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1133 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1169 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1208 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1261 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1299 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1383 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1434 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:178 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1895 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1965 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:1986 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:203 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:216 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/lock.yml:35 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/pages.yml:36 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release.yml:1110 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release.yml:126 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release.yml:49 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release.yml:517 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release.yml:738 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/GHSA-cq8v-f236-94qc |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0097, GHSA-cq8v-f236-94qc | Dependencies (osv-scanner) |
| medium | osv/GHSA-cq8v-f236-94qc |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0097, GHSA-cq8v-f236-94qc | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2023-0089 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2023-0089 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0436 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0436 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0119 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0119 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0134 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0134 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0190 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0190 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0253 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0253 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0386 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0386 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0441 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0441 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0486 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0486 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0538 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0538 | Dependencies (osv-scanner) |
| medium | opengrep/rust.lang.security.reqwest-accept-invalid |
crates/veld-core/src/tls_health.rs:185 | Dangerously accepting invalid TLS information [confidence high] | Static analysis (opengrep) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-55wc-3pg8-jfw6 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-82fw-gwwq-j7x9 |
crates/veld-daemon/ui/package-lock.json | @vitest/[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-82fw-gwwq-j7x9 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-c6gr-qvv4-5v3f |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-c6gr-qvv4-5v3f | Dependencies (osv-scanner) |
| medium | osv/GHSA-f72v-6w45-q472 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-f72v-6w45-q472 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fxqj-rqcc-2cmp |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp | Dependencies (osv-scanner) |
| medium | osv/GHSA-qxg6-89mg-rqv8 |
crates/veld-daemon/ui/package-lock.json | @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
crates/veld-daemon/ui/src/files/markdown.ts:60 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
crates/veld-daemon/ui/src/promotions/model.ts:107 | Detected the use of a regular expression `^[a-z0-9]+(-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable... | Static analysis (opengrep) |
| medium | opengrep/typescript.react.security.audit.react-href-var |
crates/veld-daemon/ui/src/shared/NodeList.tsx:262 | Detected a variable used in an anchor tag with the 'href' attribute. A malicious actor may be able to input the 'javascript:' URI, which could cause cross-site scripting (XSS). It is recommended to disallow 'javascript:' URIs within... | Static analysis (opengrep) |
| medium | opengrep/typescript.react.security.audit.react-href-var |
crates/veld-daemon/ui/src/shared/NodeList.tsx:299 | Detected a variable used in an anchor tag with the 'href' attribute. A malicious actor may be able to input the 'javascript:' URI, which could cause cross-site scripting (XSS). It is recommended to disallow 'javascript:' URIs within... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
crates/veld-daemon/ui/src/shortcuts/registry.ts:560 | Detected the use of a regular expression `^[a-z0-9]+(-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable... | Static analysis (opengrep) |
| medium | osv/GHSA-2jfj-6hjv-fm6j |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-2jfj-6hjv-fm6j | Dependencies (osv-scanner) |
| medium | osv/GHSA-2p8c-gr87-2676 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-2p8c-gr87-2676 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3wwx-pv8p-q78v |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-3wwx-pv8p-q78v | Dependencies (osv-scanner) |
| medium | osv/GHSA-3wwx-pv8p-q78v |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-3wwx-pv8p-q78v | Dependencies (osv-scanner) |
| medium | osv/GHSA-3xpg-4rpp-hhhm |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-3xpg-4rpp-hhhm | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4qv8-2p9j-2685 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 | Dependencies (osv-scanner) |
| medium | osv/GHSA-55wc-3pg8-jfw6 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6gmq-8vp8-gcm6 |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-6gmq-8vp8-gcm6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6h8r-xr42-gp59 |
desktop/package-lock.json | @xmldom/[email protected] (npm) is affected by GHSA-6h8r-xr42-gp59 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8xcm-r25x-g524 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-8xcm-r25x-g524 | Dependencies (osv-scanner) |
| medium | osv/GHSA-997q-gvvc-jwmx |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-997q-gvvc-jwmx | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fm3-97px-rjf6 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-f72v-6w45-q472 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-f72v-6w45-q472 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fw47-9c62-h3vw |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-fw47-9c62-h3vw | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 | Dependencies (osv-scanner) |
| medium | osv/GHSA-hrr3-gc8f-f4qj |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj | Dependencies (osv-scanner) |
| medium | osv/GHSA-jr45-8vmc-qm54 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-jr45-8vmc-qm54 | Dependencies (osv-scanner) |
| medium | osv/GHSA-m8rv-5g2x-5cg5 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-pmjh-fq2x-6v4x |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-pmjh-fq2x-6v4x | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-rx4f-c7p8-82vq |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-rx4f-c7p8-82vq | Dependencies (osv-scanner) |
| medium | osv/GHSA-v3r7-h72x-cjcm |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm | Dependencies (osv-scanner) |
| medium | osv/GHSA-w74x-v6f9-j3xg |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjr9-j795-jxcr |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr | Dependencies (osv-scanner) |
| medium | osv/GHSA-x562-297c-g43g |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-x562-297c-g43g | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
desktop/src/waitingScreen.js:155 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
desktop/src/waitingScreen.js:156 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
desktop/src/waitingScreen.js:159 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
desktop/src/waitingScreen.js:169 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
desktop/src/waitingScreen.js:178 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | osv/GHSA-39w2-rjm5-chcv |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-39w2-rjm5-chcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-4633-3j49-mh5q |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-4633-3j49-mh5q | Dependencies (osv-scanner) |
| medium | osv/GHSA-4c39-4ccg-62r3 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-4c39-4ccg-62r3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-4jqv-mc3x-m676 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-4jqv-mc3x-m676 | Dependencies (osv-scanner) |
| medium | osv/GHSA-68g3-v927-f742 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-68g3-v927-f742 | Dependencies (osv-scanner) |
| medium | osv/GHSA-955p-x3mx-jcvp |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-955p-x3mx-jcvp | Dependencies (osv-scanner) |
| medium | osv/GHSA-f87g-xv8r-7p7x |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-f87g-xv8r-7p7x | Dependencies (osv-scanner) |
| medium | osv/GHSA-ffhc-5mcf-pf4q |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-ffhc-5mcf-pf4q | Dependencies (osv-scanner) |
| medium | osv/GHSA-fxqj-rqcc-2cmp |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp | Dependencies (osv-scanner) |
| medium | osv/GHSA-gx5p-jg67-6x7h |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-gx5p-jg67-6x7h | Dependencies (osv-scanner) |
| medium | osv/GHSA-h64f-5h5j-jqjh |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-h64f-5h5j-jqjh | Dependencies (osv-scanner) |
| medium | osv/GHSA-mcj8-r9mp-w47p |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-mcj8-r9mp-w47p | Dependencies (osv-scanner) |
| medium | osv/GHSA-q8wf-6r8g-63ch |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-q8wf-6r8g-63ch | Dependencies (osv-scanner) |
| medium | osv/GHSA-qx2v-qp2m-jg93 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv | Dependencies (osv-scanner) |
| medium | osv/GHSA-wfc6-r584-vfw7 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-wfc6-r584-vfw7 | Dependencies (osv-scanner) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
crates/veld-daemon/ui/src/files/gutter.ts:79 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
crates/veld-daemon/ui/src/files/gutter.ts:84 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/browserViews.js:28 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/browserViews.js:39 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/browserViews.js:54 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/browserViews.js:57 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/browserViews.js:58 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/main.js:21 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/main.js:22 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/main.js:23 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/main.js:24 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/main.js:36 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/main.js:37 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/main.js:38 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/updater.js:28 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/updater.js:29 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
desktop/src/updater.js:719 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
desktop/src/updater.js:719 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
desktop/src/waitingScreen.js:178 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
desktop/src/waitingScreen.js:178 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/windows.js:24 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
desktop/src/windows.js:35 | `const` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1035 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1165 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1166 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1217 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1219 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1223 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1225 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1229 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1233 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1248 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1249 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1275 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1276 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1539 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1614 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1616 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:1635 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:236 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:360 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:745 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
install.sh:909 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
scripts/veld/claude-sessions.sh:112 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/veld/claude-sessions.sh:112 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/console.rs:425 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/console.rs:438 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/db/mod.rs:2638 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/db/mod.rs:2640 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/db/mod.rs:2659 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld-core/src/db/mod.rs:555 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/engine_lock.rs:23 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/helper_store.rs:1009 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/helper_store.rs:1019 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/helper_store.rs:1117 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/helper_store.rs:1132 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/helper_store.rs:662 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/instance.rs:272 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/instance.rs:622 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/logging/pump.rs:140 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/logging/pump.rs:233 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/paths.rs:445 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:1842 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:1863 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:1884 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:1925 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:1947 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:1972 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:1997 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2025 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2053 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2088 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2131 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2168 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2194 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2214 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2292 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2320 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2351 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/process.rs:2380 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld-core/src/process.rs:534 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld-core/src/setup.rs:2638 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld-core/src/setup.rs:3460 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/setup.rs:4509 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/setup.rs:506 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/shell.rs:396 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/shell.rs:470 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/signing.rs:1294 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/signing.rs:1339 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:1480 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:1706 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
crates/veld-core/src/signing.rs:2360 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:2548 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:2614 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:2648 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:2697 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:2746 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:2854 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:2893 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:3006 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:3040 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:3061 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-core/src/signing.rs:3079 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/update_lock.rs:669 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-core/src/user_path.rs:756 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
crates/veld-daemon/frontend/tests/public-url.test.ts:11 | Possible generic-api-key secret in history (commit 57d398308c); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/veld-daemon/frontend/tests/sharing.test.ts:19 | Possible generic-api-key secret in history (commit a3ca7bbc43); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
crates/veld-daemon/frontend/tests/web-share.test.ts:14 | Possible generic-api-key secret in history (commit 7c6b2c9453); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/desktop.rs:4174 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine.rs:596 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine.rs:713 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine.rs:745 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine.rs:798 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine.rs:835 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine.rs:845 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine.rs:888 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine_query.rs:106 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine_query.rs:147 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/engine_worker.rs:268 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/extensions.rs:1262 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/extensions.rs:2449 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/extensions.rs:2510 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/extensions.rs:2538 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/gc.rs:561 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/main.rs:178 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
crates/veld-daemon/src/main.rs:48 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/management.rs:1537 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/monitor.rs:1002 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-daemon/src/monitor.rs:1105 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty.rs:10108 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-daemon/src/pty.rs:1253 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld-daemon/src/pty.rs:1380 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty.rs:4128 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-daemon/src/pty.rs:6428 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-daemon/src/pty.rs:7454 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-daemon/src/pty.rs:7481 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-daemon/src/pty.rs:8512 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty.rs:9500 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1323 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1328 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1331 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1335 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1423 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1454 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1477 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1478 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1591 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1856 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:1985 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:2276 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:2282 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:2290 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:2304 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:2313 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/pty/holder.rs:2316 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld-daemon/src/pty/shims.rs:1472 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/settings.rs:698 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-daemon/src/settings.rs:717 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | osv/GHSA-9jrq-w75r-8gcw |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | osv/GHSA-vfgh-jcmw-g37q |
crates/veld-daemon/ui/package-lock.json | [email protected] (npm) is affected by GHSA-vfgh-jcmw-g37q | Dependencies (osv-scanner) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-engine/src/orchestrator.rs:5423 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-engine/src/run_action.rs:240 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
crates/veld-gateway/src/main.rs:26 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
crates/veld-gateway/tests/loopback.rs:401 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-helper/src/caddy.rs:1781 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-helper/src/caddy.rs:1786 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-helper/src/caddy.rs:1795 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-helper/src/caddy.rs:2079 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-helper/src/caddy.rs:2115 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld-helper/src/main.rs:109 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
crates/veld-helper/src/main.rs:142 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
crates/veld-helper/src/main.rs:221 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-helper/src/main.rs:223 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-helper/src/main.rs:548 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-helper/src/main.rs:556 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-helper/src/main.rs:560 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-helper/src/main.rs:989 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-helper/src/migrate.rs:392 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-share/src/lib.rs:139 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld-sign/src/main.rs:1085 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
crates/veld-sign/src/main.rs:804 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | gitleaks/private-key |
crates/veld-sign/tests/smoke.rs:324 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-stats/src/procmem.rs:388 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld-stats/src/procmem.rs:99 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/agent.rs:244 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/agent.rs:44 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/desktop.rs:542 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/doctor.rs:146 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/veld/src/commands/doctor.rs:2623 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/doctor.rs:968 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld/src/commands/gc.rs:55 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/setup/privileged.rs:23 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/uninstall.rs:26 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/update.rs:1318 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/update.rs:1484 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld/src/commands/update.rs:2004 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld/src/commands/update.rs:2048 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld/src/commands/update.rs:2052 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/commands/update.rs:824 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld/src/engine_client.rs:389 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
crates/veld/src/engine_client.rs:468 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/engine_client.rs:493 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args-os |
crates/veld/src/main.rs:322 | args_os should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
crates/veld/src/main.rs:604 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | osv/GHSA-2gqq-gqf2-x968 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-2gqq-gqf2-x968 | Dependencies (osv-scanner) |
| low | osv/GHSA-333x-w4r6-6crp |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-333x-w4r6-6crp | Dependencies (osv-scanner) |
| low | osv/GHSA-3qxv-5xgr-q7w9 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-3qxv-5xgr-q7w9 | Dependencies (osv-scanner) |
| low | osv/GHSA-8436-99hf-9mmv |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-8436-99hf-9mmv | Dependencies (osv-scanner) |
| low | osv/GHSA-98mx-cjp9-gchm |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-98mx-cjp9-gchm | Dependencies (osv-scanner) |
| low | osv/GHSA-h3v5-h239-pg29 |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-h3v5-h239-pg29 | Dependencies (osv-scanner) |
| low | osv/GHSA-r53p-7pc4-xj5r |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r | Dependencies (osv-scanner) |
| low | osv/GHSA-r53p-7pc4-xj5r |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r | Dependencies (osv-scanner) |
| low | osv/GHSA-xhq7-xmqj-769h |
desktop/package-lock.json | [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h | Dependencies (osv-scanner) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
desktop/src/browserViews.js:812 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
docs/signing-key-rotation.md:153 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | osv/GHSA-3g8h-86w9-wvmq |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-3g8h-86w9-wvmq | Dependencies (osv-scanner) |
| low | osv/GHSA-vfv6-92ff-j949 |
testproject-nextjs/package-lock.json | [email protected] (npm) is affected by GHSA-vfv6-92ff-j949 | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
tests/signing-slots.py:306 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/test-injection.sh:252 | Possible generic-api-key secret in history (commit aed79c99df); removed from the current tree but still retrievable | Secrets (gitleaks) |
| info | zizmor/template-injection |
.github/workflows/release.yml:1125 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release.yml:177 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release.yml:398 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release.yml:450 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-4 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 94 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 26 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 165 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 164 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 10 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 6ebb5ea31397 | prov-5+qual-2+sec-2 | 24% | 79 | 51 |
| 2026-11-14 | 6ebb5ea31397 | prov-4+qual-2+sec-2 | 24% | 79 | 51 |
Full text report
- Repository: https://github.com/prosperity-solutions/veld
- Commit:
6ebb5ea313971c4e2ac9d7c4c487aa43d9b861c1 - Generated: 2026-11-14T14:52:06+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 24 | explicit | 95% | 100% |
| Code quality | 79 | adequate | 90% | 100% |
| Security | 51 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 24% of first-party code added; an estimated 24% including velocity signals.
- Explicitly attributed share (lower bound): 24.5%
- Unattributed share in AI-consistent velocity bursts: 41.1%
- Estimated AI-generated share: 24.5%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 286 | 94,297 |
- AI tooling configured in repo: claude-code, gemini, generic-agent
Current source lines last changed by AI-attributed commits: 47,629 of 269,483.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.378 | 0.343 | 1.1x |
| Security | 0.441 | 0.654 | 0.67x |
- Stylometry index: 0.17 per 1,000 lines (narrated steps 17, placeholders 0, assistant phrasing 0, emoji 42). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-03 | 57,731 | 79% |
| 2026-05 | 38 | 0% |
| 2026-06 | 884 | 100% |
| 2026-07 | 81,263 | 5% |
| 2026-08 | 142,502 | 0% |
| 2026-09 | 44,639 | 33% |
| 2026-10 | 47,734 | 42% |
| 2026-11 | 10,239 | 86% |
Evidence
- Claude Code: message 'Generated with [Claude Code' (30adebcb7a87)
- Claude Code: message 'Generated with [Claude Code' (26c9cd8284a8)
- Claude Code: trailer 'Co-authored-by: Claude' (66bf20d1c1eb)
- Claude Code: message 'Generated with [Claude Code' (ead118bad12f)
- Claude Code: trailer 'Co-authored-by: Claude' (c094a8b5139a)
- Claude Code: message 'Generated with [Claude Code' (1c854796bc31)
- Claude Code: trailer 'Co-authored-by: Claude' (38f2fb16d775)
- Claude Code: trailer 'Co-authored-by: Claude' (f2026f0091a3)
- Claude Code: trailer 'Co-authored-by: Claude' (0a181c2b6f77)
- Claude Code: trailer 'Co-authored-by: Claude' (f6749fa83a5d)
- Claude Code: message 'Generated with [Claude Code' (2acbd5e314a8)
- Claude Code: trailer 'Co-authored-by: Claude' (633ef2ba2c8c)
- Claude Code: message 'Generated with [Claude Code' (6442034c3538)
- Claude Code: trailer 'Co-authored-by: Claude' (0654b42bff28)
- Claude Code: trailer 'Co-authored-by: Claude' (a7049fb7083f)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.13, CI runs tests; 23% of function code in complex or long functions; 2% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 51 |
| Duplication | 87 |
| Code smells (Opengrep) | 95 |
| Tests and CI | 82 |
| Documentation | 80 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 9,285; mean complexity 3.1, 90th percentile 6; 198 complex and 127 long functions
- Duplicated lines: 2.3% of 210,344 compared
- Tests: 35,704 test lines for 269,483 source lines (ratio 0.13); CI test commands: npm test, go test, cargo test, vitest; 68% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- AppInner in crates/veld-daemon/ui/src/App.tsx: complexity 212, 1357 lines
- DatabaseHealthDialog in crates/veld-daemon/ui/src/components/dialogs.tsx: complexity 175, 1163 lines
- BrowserPane in crates/veld-daemon/ui/src/panes/BrowserPane.tsx: complexity 165, 1068 lines
- validate in crates/veld-core/src/db/settings.rs: complexity 128, 356 lines
- PaneChooser in crates/veld-daemon/ui/src/panes/PaneArea.tsx: complexity 100, 652 lines
Security
Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 165 known vulnerabilities in 41 dependencies; 1 high-severity SAST findings; 1 high-severity workflow issues. Weakest area: dependencies.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 49 |
| Static analysis (Opengrep) | 95 |
| Vulnerable dependencies (OSV) | 2 |
| CI workflows (zizmor) | 58 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 165 in 41 packages (critical 8, high 73, medium 58, low 13)
-
Posture checks passed: dependency updates, signed commits; missing: security policy, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-cg2g-xh64-v4q7: [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 |
crates/veld-daemon/ui/package-lock.json |
| critical | osv/GHSA-5gmw-xhrv-c9v3: [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 |
crates/veld-daemon/ui/package-lock.json |
| critical | osv/GHSA-85c8-ppgw-ccpr: [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr |
crates/veld-daemon/ui/package-lock.json |
| critical | osv/GHSA-2464-fhr4-w9xw: [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw |
testproject-nextjs/package-lock.json |
| critical | osv/GHSA-2xp9-vwfh-vxw4: [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4 |
testproject-nextjs/package-lock.json |
| critical | osv/GHSA-673q-mjm6-r5xr: [email protected] (npm) is affected by GHSA-673q-mjm6-r5xr |
testproject-nextjs/package-lock.json |
| critical | osv/GHSA-p293-qw3h-jr36: [email protected] (npm) is affected by GHSA-p293-qw3h-jr36 |
testproject-nextjs/package-lock.json |
| critical | osv/GHSA-vcvr-r3jv-pc5j: [email protected] (npm) is affected by GHSA-vcvr-r3jv-pc5j |
testproject-nextjs/package-lock.json |
| high | gitleaks/private-key: Possible private-key secret in the current tree |
crates/veld-sign/src/main.rs:340 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
crates/veld-daemon/src/pty.rs:7931 |
| high | osv/RUSTSEC-2026-0194: [email protected] (crates.io) is affected by RUSTSEC-2026-0194 |
Cargo.lock |
| high | osv/RUSTSEC-2026-0195: [email protected] (crates.io) is affected by RUSTSEC-2026-0195 |
Cargo.lock |
| high | osv/GHSA-73wf-gq98-2v4g: [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-c83g-rgw3-j3cx: [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-mrv2-3pqr-j5jr: [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-gfr2-rv44-r23c: [email protected] (npm) is affected by GHSA-gfr2-rv44-r23c |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-2v37-7h3g-55p8: [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-68fv-2mgg-jv7q: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q; also in testproject-nextjs/package-lock.json |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-2m5v-pch6-74hx: [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-4w7w-5xrc-9h26: [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-qrxm-fqhp-jwvm: [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-xjj6-f33q-929c: [email protected] (npm) is affected by GHSA-xjj6-f33q-929c |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-587h-7wmj-h5pm: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm |
crates/veld-daemon/ui/package-lock.json |
| high | osv/GHSA-27p8-2357-5qqv: @xmldom/[email protected] (npm) is affected by GHSA-27p8-2357-5qqv |
desktop/package-lock.json |
| high | osv/GHSA-4w3w-2rp5-g8jm: @xmldom/[email protected] (npm) is affected by GHSA-4w3w-2rp5-g8jm |
desktop/package-lock.json |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v17.10.0 ships veld-17.10.0-linux-amd64.tar.gz (2 downloads)
- binary-release-asset: release v17.10.0 ships veld-17.10.0-linux-arm64.tar.gz (1 downloads)
- binary-release-asset: release v17.10.0 ships veld-17.10.0-macos-amd64.tar.gz (2 downloads)
- binary-release-asset: release v17.10.0 ships veld-17.10.0-macos-arm64.tar.gz (8 downloads)
- binary-release-asset: release v17.10.0 ships veld-desktop-17.10.0-linux-amd64.deb (1 downloads)
- readme-download-lure: gives an archive password
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 269,483; test lines: 35,704
| Language | Lines |
|---|---|
| Rust | 190,708 |
| TypeScript | 90,438 |
| JavaScript | 15,036 |
| Shell | 6,262 |
| Python | 2,743 |