Leaderboard github.com
tryskian/polinko
Human-led AI evaluation research system for observing model behaviour through binary evals, signal traces, and retained failures.
AI provenance
88%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
54/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
75/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
88% explicit
Explicit AI attribution on 88% of first-party code added; an estimated 88% including velocity signals.
How the score is built
- Explicitly attributed share88%
- Unattributed share in AI-pace bursts2%
- Estimated AI-generated share88%
- AI tool configuration files0
- Work sessions at AI pace17
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.00
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| OpenAI Codex | 1,083 | 171,294 | 2026-03-04 | 2026-10-03 |
Lines added per month all AI-attributed share
- 2026-0214,678 · 0% AI
- 2026-0325,372 · 75% AI
- 2026-0459,199 · 95% AI
- 2026-0567,551 · 100% AI
- 2026-0620,804 · 100% AI
- 2026-077,420 · 100% AI
- 2026-08106 · 100% AI
- 2026-09133 · 100% AI
- 2026-104 · 0% AI
- 2026-110 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 56,666 lines trace to AI-attributed commits, 3,454 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 3.48 | 0.87 | 4.00× |
| Security | 1.17 | 0.29 | 4.02× |
Evidence by analyzer
Explicit AI attributionok26 items
- OpenAI Codex: 1083 attributed commits, 171,294 lines added
- OpenAI Codex: PR branch 'codex/bigbrain/security-closeout-20261003'
- OpenAI Codex: PR branch 'codex/bigbrain/detach-repo-power-control'
- OpenAI Codex: PR branch 'codex/dependabot-vulnerability-refresh'
- OpenAI Codex: PR branch 'codex/bigbrain/refresh-js-yaml-security'
- OpenAI Codex: PR branch 'codex/bigbrain/build-week-readme'
- OpenAI Codex: PR branch 'codex/bigbrain/node-security-overrides'
- OpenAI Codex: PR branch 'codex/bigbrain/build-week-demo-no-popup'
- OpenAI Codex: PR branch 'codex/bigbrain/ocr-demo-terminal-readability'
- OpenAI Codex: PR branch 'codex/bigbrain/closeout-build-week-demo-state'
- OpenAI Codex: PR branch 'codex/bigbrain/build-week-eval-demo-strategy'
- OpenAI Codex: PR branch 'codex/bigbrain/site-pitch-gate-signal-copy'
- OpenAI Codex: PR branch 'codex/bigbrain/site-theme-transition'
- OpenAI Codex: PR branch 'codex/bigbrain/closeout-site-layout-state'
- OpenAI Codex: PR branch 'codex/bigbrain/startup-server-contract'
- OpenAI Codex: PR branch 'codex/bigbrain/website-binary-pitch'
- OpenAI Codex: PR branch 'codex/bigbrain/force-about-redirect'
- OpenAI Codex: PR branch 'codex/bigbrain/site-route-contract'
- OpenAI Codex: PR branch 'codex/bigbrain/site-source-readme-link'
- OpenAI Codex: PR branch 'codex/bigbrain/fix-theme-route-blink'
- OpenAI Codex: PR branch 'codex/bigbrain/binary-gate-framing'
- OpenAI Codex: PR branch 'codex/bigbrain/polinko-seo-surface'
- OpenAI Codex: PR branch 'codex/bigbrain/krystian-io-site-port'
- OpenAI Codex: PR branch 'codex/bigbrain/github-health-stale-branch-filter'
- OpenAI Codex: PR branch 'codex/bigbrain/restore-research-packet'
- OpenAI Codex: PR branch 'codex/bigbrain/runtime-cache-cleanup'
- attributed_commit_share
- 86.8%
- attributed_commits
- 1,083
- attributed_loc
- 171,294
- attributed_loc_share
- 87.7%
- commits
- 1,248
- effective_loc
- 195,267
- tools_detected
- 1
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok15 items
- 3,739 lines of first-party code in ~0.5h (7,478 lines/hour, PR #480)
- 4,453 lines of first-party code in ~0.6h (7,381 lines/hour, PR #294)
- 4,105 lines of first-party code in ~0.7h (5,804 lines/hour, PR #570)
- 4,210 lines of first-party code in ~0.8h (5,344 lines/hour, 1 commit session)
- 4,265 lines of first-party code in ~1.0h (4,286 lines/hour, 2 commit session)
- 5,668 lines of first-party code in ~1.9h (2,949 lines/hour, 5 commit session)
- 4,061 lines of first-party code in ~1.4h (2,801 lines/hour, 1 commit session)
- 1,167 lines of first-party code in ~0.5h (2,334 lines/hour, PR #574)
- 4,073 lines of first-party code in ~3.3h (1,236 lines/hour, PR #296)
- 4,429 lines of first-party code in ~4.0h (1,107 lines/hour, 1 commit session)
- 4,419 lines of first-party code in ~4.1h (1,086 lines/hour, PR #443)
- 4,330 lines of first-party code in ~4.0h (1,082 lines/hour, 1 commit session)
- 4,181 lines of first-party code in ~4.0h (1,045 lines/hour, 1 commit session)
- 1,859 lines of first-party code in ~2.0h (917 lines/hour, 2 commit session)
- 1,237 lines of first-party code in ~1.6h (759 lines/hour, 3 commit session)
- excluded_import_loc
- 0
- flagged_loc
- 60,655
- flagged_loc_share
- 31.1%
- flagged_units
- 17
- max_loc_per_hour
- 7,478
- measured_loc
- 195,267
- median_loc_per_hour
- 285.02
- pr_timed_units
- 653
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 785
Release velocityskipped
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0
- lines_scanned
- 56,016
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 56,666
- blame_failures
- 0
- files_blamed
- 193
- other_lines
- 3,454
- quality:ai_findings
- 197
- quality:ai_per_kloc
- 3.48
- quality:other_findings
- 3
- quality:other_per_kloc
- 0.87
- quality:ratio
- 4
- security:ai_findings
- 66
- security:ai_per_kloc
- 1.17
- security:other_findings
- 1
- security:other_per_kloc
- 0.29
- security:ratio
- 4.02
Code quality
54 weak
Code quality is weak: test-to-source ratio 0.71, CI runs tests; 49% of function code in complex or long functions; 14% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity23
- Duplication44
- Lint and smells40
- Tests and CI100
- Documentation65
- Type safety0
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- build_from_export in tools/build_ocr_cases_from_export.py: complexity 236, 879 lines
- toJSON in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 150, 1 lines
- n in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 127, 1 lines
- o.render in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 126, 1 lines
- it in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 125, 1 lines
- build_fail_cohort in tools/build_ocr_growth_fail_cohort.py: complexity 121, 444 lines
- init in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 96, 1 lines
- h in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 94, 1 lines
- s.render in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 89, 1 lines
- e in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 78, 1 lines
- complex_functions
- 230
- function_nloc
- 43,301
- functions
- 3,063
- long_functions
- 79
- many_param_functions
- 34
- mean_ccn
- 5.55
- p90_ccn
- 12
- risky_nloc_share
- 49.3%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:979 and .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:995
- 6+ duplicated lines: .archive/quarantine/portfolio-2026-06-29/tools/run_portfolio_mockups.sh:8 and tools/run_eval_sidecar_start.sh:8
- 6+ duplicated lines: src/polinko/api/app_factory.py:220 and src/polinko/api/app_factory.py:1334
- 6+ duplicated lines: src/polinko/api/app_factory.py:329 and src/polinko/config.py:16
- 6+ duplicated lines: src/polinko/api/app_factory.py:491 and src/polinko/core/history_store.py:53
- 6+ duplicated lines: src/polinko/api/eval_viz.py:626 and src/polinko/api/eval_viz.py:833
- 6+ duplicated lines: src/polinko/api/eval_viz.py:717 and src/polinko/api/manual_evals_surface.py:739
- 6+ duplicated lines: src/polinko/api/evidence_sankey.py:174 and src/polinko/api/evidence_sankey.py:188
- 6+ duplicated lines: src/polinko/api/manual_evals_surface.py:47 and src/polinko/api/manual_evals_surface.py:507
- 6+ duplicated lines: src/polinko/api/manual_evals_surface.py:294 and tools/build_manual_evals_db.py:312
- compared_lines
- 46,679
- duplicated_lines
- 6,451
- duplicated_share
- 13.8%
- files
- 193
Lintok
- category:best-practice
- 4
- category:correctness
- 297
- category:maintainability
- 28
- findings
- 329
- scanned_lines
- 60,120
- weighted_findings
- 221.25
Tests and CIok4 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/dependency-review.yml
.github/workflows/dependency-review.yml - CI runs tests (make ci)
- CI runs linters (ruff, mypy)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 2
- cochange_commits
- 169
- cochange_share
- 94.7%
- source_lines
- 60,120
- test_lines
- 42,939
- test_ratio
- 0.71
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 97
Type safetyok
- check:low_escape_density
- no
- check:strict_config
- no
- escapes
- 1,012
- escapes_per_kloc
- 20.02
Security
75 adequate
Security posture is adequate: 41 high-severity SAST findings; 17 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets85
- Static analysis (SAST)80
- Vulnerable dependencies100
- CI workflows2
- Security posture100
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 111
- declared
- 111
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 1
- secrets_nonprod
- 4
Static analysis (opengrep)ok
- findings
- 68
- findings_high
- 41
- findings_low
- 0
- findings_medium
- 27
- parse_errors
- 6
- scanned_lines
- 60,120
- weighted_findings
- 38.90
Dependencies (osv-scanner)ok
- penalty
- 0
- vulnerabilities
- 0
- vulnerable_packages
- 0
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 29
- findings_high
- 17
- findings_low
- 8
- findings_medium
- 4
- penalty
- 222.40
- workflows
- 2
Security postureok2 items
- Security policy: https://github.com/tryskian/polinko/security/policy
https://github.com/tryskian/polinko/security/policy - Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 100.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
87 high110 medium105 low
302 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3119 | function `request_logging` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3156 | function `health` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3172 | function `pass_fail_viz` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3180 | function `pass_fail_viz_data` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3189 | function `pass_fail_viz_image` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3215 | function `pass_fail_viz_artifact` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3242 | function `manual_evals_surface` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3251 | function `metrics` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3256 | function `list_chats` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3267 | function `create_chat` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3275 | function `list_chat_messages` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3287 | function `list_chat_feedback` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3299 | function `submit_chat_feedback` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3367 | function `list_eval_checkpoints` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3386 | function `submit_eval_checkpoint` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3437 | function `export_chat` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3474 | function `run_ocr` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3662 | function `pdf_ingest` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:3861 | function `file_search` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4058 | function `rename_chat` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4071 | function `delete_chat` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4087 | function `deprecate_chat` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4098 | function `add_note` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4107 | function `set_chat_personalization` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4139 | function `get_chat_personalization` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4160 | function `get_chat_collaboration` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4179 | function `handoff_chat_collaboration` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
src/polinko/api/app_factory.py:4686 | function `reset_session` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.correctness.no-strings-as-booleans |
tools/build_ocr_cases_from_export.py:1542 | Using strings as booleans in Python has unexpected results. `"one" and "two"` will return "two". `"one" or "two"` will return "one". In Python, strings are truthy, and strings with a non-zero length evaluate to True. | Lint |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
.archive/quarantine/portfolio-2026-06-29/tools/build_portfolio_static.py:31 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:108 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:109 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:124 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:125 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:20 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:40 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:56 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:76 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:77 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:92 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:93 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependency-review.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dependency-review.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/dockerfile.security.missing-user |
Dockerfile:16 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-audit |
main.py:40 | Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/eval_viz.py:690 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/eval_viz.py:831 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/evidence_sankey.py:100 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/evidence_sankey.py:102 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/manual_evals_surface.py:101 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/manual_evals_surface.py:156 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/manual_evals_surface.py:276 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/manual_evals_surface.py:309 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/manual_evals_surface.py:569 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/manual_evals_surface.py:856 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/api/manual_evals_surface.py:926 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/core/history_store.py:465 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
src/polinko/core/vector_store.py:268 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/build_manual_evals_db.py:323 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/build_manual_evals_db.py:350 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/build_manual_evals_db.py:374 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/build_manual_evals_db.py:400 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/check_shell_scripts.py:132 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/doctor_env.py:183 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/doctor_env.py:50 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/eval_ocr_batched.py:203 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/eval_ocr_stability.py:313 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/eval_ocr_stability.py:317 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/eval_parallel_orchestrator.py:121 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/eval_sidecar.py:108 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/github_health.py:184 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/launch_detached_process.py:110 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/manual_eval_feedback_reclassify.py:627 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/manual_eval_no_context_feedback_reclassify.py:645 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/manual_eval_ocr_retry_feedback_closure_apply.py:424 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/manual_eval_ocr_retry_feedback_db.py:101 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
tools/manual_eval_open_feedback.py:174 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/render_mermaid_diagrams.py:167 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/repo_search.py:105 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/run_dependency_lock.py:19 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/run_dependency_lock.py:32 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/run_dependency_lock.py:57 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
tools/run_doctor_env.py:51 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
src/polinko/api/app_factory.py:1237 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
src/polinko/api/app_factory.py:1464 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
tools/client.py:22 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
tools/eval_chat_common.py:22 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/eval_file_search_common.py:112 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
tools/eval_ocr.py:226 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/eval_ocr_batched.py:61 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
tools/eval_retrieval.py:50 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/github_health.py:378 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_feedback_decisions.py:321 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_feedback_decisions.py:719 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_feedback_decisions.py:805 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_feedback_reclassify.py:145 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_feedback_reclassify.py:58 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_feedback_reclassify.py:611 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_health_report.py:421 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_health_report.py:426 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_no_context_feedback_reclassify.py:629 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_no_context_feedback_reclassify.py:67 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_candidates.py:325 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_candidates.py:362 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_candidates.py:369 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_execution_readiness.py:312 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_execution_report.py:23 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_execution_report.py:71 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_feedback_closure_apply.py:407 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_feedback_closure_formatters.py:147 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_feedback_closure_formatters.py:18 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_feedback_closure_formatters.py:215 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_feedback_closure_formatters.py:83 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_input_packet.py:407 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_input_packet.py:454 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_input_packet.py:463 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_input_packet.py:482 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_input_packet.py:488 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_rerun_manifest.py:348 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_rerun_manifest.py:394 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_rerun_manifest.py:410 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_rerun_plan.py:353 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_rerun_plan.py:409 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_rerun_plan.py:419 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_apply_preview.py:364 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_decision_draft.py:283 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_review.py:367 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_review.py:424 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_review.py:440 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_review.py:443 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_review.py:445 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_template.py:262 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_template.py:322 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_template.py:337 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_template.py:340 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_template.py:342 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_template.py:344 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_validation.py:117 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_validation.py:489 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_selection_validation.py:68 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_source_provenance.py:427 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_source_provenance.py:473 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_source_verification.py:282 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_source_verification.py:322 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_source_verification.py:329 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_source_verification.py:349 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_ocr_retry_source_verification.py:354 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_open_feedback.py:561 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_open_feedback.py:594 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_open_feedback.py:607 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_open_feedback.py:640 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_open_feedback.py:669 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_overlay_readiness.py:386 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_overlay_readiness.py:426 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_overlay_readiness.py:435 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_overlay_readiness.py:439 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_overlay_source_index.py:622 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_overlay_source_index.py:632 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_overlay_source_index.py:662 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_source_context.py:405 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_eval_source_context.py:440 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
tools/manual_evals_db_status.py:46 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:3667 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:3667 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:3667 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:4002 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:4080 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:17 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:3 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:35 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:54 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | opengrep/python.flask.security.audit.directly-returned-format-string |
src/polinko/api/app_factory.py:709 | Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.formatted-sql-query |
src/polinko/api/evidence_sankey.py:100 | Detected possible formatted SQL query. Use parameterized queries instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.formatted-sql-query |
src/polinko/api/manual_evals_surface.py:101 | Detected possible formatted SQL query. Use parameterized queries instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.formatted-sql-query |
src/polinko/api/manual_evals_surface.py:156 | Detected possible formatted SQL query. Use parameterized queries instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.formatted-sql-query |
src/polinko/api/manual_evals_surface.py:569 | Detected possible formatted SQL query. Use parameterized queries instead. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
tools/eval_ocr.py:25 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
tools/openai_account_summary.py:136 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
tools/render_public_d3_diagrams.mjs:287 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | `d` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | `r` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | `n` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | `_` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1 | `_` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:113 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:113 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1253 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1253 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:127 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:127 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1404 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1404 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1499 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1499 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1505 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1505 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1514 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1514 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1519 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1519 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1533 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1533 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1615 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1615 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1663 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1663 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1754 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1754 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1767 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1767 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:190 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:190 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1967 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:1967 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2008 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2008 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2044 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2044 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2081 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2081 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:211 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:211 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2125 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2125 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2243 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2243 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2613 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2613 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2618 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2618 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2630 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2630 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:2637 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:283 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:283 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:3 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:350 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:350 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:486 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:486 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:494 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:494 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:5 | `h` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:551 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:551 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:584 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:584 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:621 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:621 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:638 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:638 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:652 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:652 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:7 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:7 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:71 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:71 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:770 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:770 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:786 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:786 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:803 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:803 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:893 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
.archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js:893 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | zizmor/artipacked |
.github/workflows/ci.yml:108 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:124 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:20 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
.github/workflows/ci.yml:32 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:39 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:55 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:76 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:92 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/dependency-review.yml:17 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
tests/test_api.py:29 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/test_config.py:11 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/test_entrypoints.py:84 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/test_public_repo_audit.py:41 | Possible generic-api-key secret in history (commit f1bc99fe45); removed from the current tree but still retrievable | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 29 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 68 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 5 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 31f74b8cd751 | prov-5+qual-2+sec-2 | 88% | 54 | 75 |
| 2026-11-14 | 31f74b8cd751 | prov-4+qual-2+sec-2 | 88% | 54 | 75 |
Full text report
- Repository: https://github.com/tryskian/polinko
- Commit:
31f74b8cd7513a8a70dfa982f4681ec988a21388 - Generated: 2026-11-14T14:52:08+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 88 | explicit | 95% | 100% |
| Code quality | 54 | weak | 90% | 100% |
| Security | 75 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 88% of first-party code added; an estimated 88% including velocity signals.
- Explicitly attributed share (lower bound): 87.7%
- Unattributed share in AI-consistent velocity bursts: 1.9%
- Estimated AI-generated share: 87.7%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 1,083 | 171,294 |
Current source lines last changed by AI-attributed commits: 56,666 of 60,120.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 3.477 | 0.869 | 4.0x |
| Security | 1.165 | 0.29 | 4.02x |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-02 | 14,678 | 0% |
| 2026-03 | 25,372 | 75% |
| 2026-04 | 59,199 | 95% |
| 2026-05 | 67,551 | 100% |
| 2026-06 | 20,804 | 100% |
| 2026-07 | 7,420 | 100% |
| 2026-08 | 106 | 100% |
| 2026-09 | 133 | 100% |
| 2026-10 | 4 | 0% |
Evidence
- OpenAI Codex: PR branch 'codex/bigbrain/security-closeout-20261003' (a46cb298fca0)
- OpenAI Codex: PR branch 'codex/bigbrain/detach-repo-power-control' (7e17eff3c725)
- OpenAI Codex: PR branch 'codex/dependabot-vulnerability-refresh' (2fef9fb4d8a4)
- OpenAI Codex: PR branch 'codex/bigbrain/refresh-js-yaml-security' (1cf46d553863)
- OpenAI Codex: PR branch 'codex/bigbrain/build-week-readme' (18fa2b7d791f)
- OpenAI Codex: PR branch 'codex/bigbrain/node-security-overrides' (3e0b3c26708b)
- OpenAI Codex: PR branch 'codex/bigbrain/build-week-demo-no-popup' (d85eab5d2c6c)
- OpenAI Codex: PR branch 'codex/bigbrain/ocr-demo-terminal-readability' (8339ada2fda7)
- OpenAI Codex: PR branch 'codex/bigbrain/closeout-build-week-demo-state' (7afd5a4809c5)
- OpenAI Codex: PR branch 'codex/bigbrain/build-week-eval-demo-strategy' (10874f7eab1c)
- OpenAI Codex: PR branch 'codex/bigbrain/site-pitch-gate-signal-copy' (ab01cb59b3e8)
- OpenAI Codex: PR branch 'codex/bigbrain/site-theme-transition' (a68be09f208f)
- OpenAI Codex: PR branch 'codex/bigbrain/closeout-site-layout-state' (756486fbd104)
- OpenAI Codex: PR branch 'codex/bigbrain/startup-server-contract' (e6bbed063edb)
- OpenAI Codex: PR branch 'codex/bigbrain/website-binary-pitch' (8016e9c18f69)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.71, CI runs tests; 49% of function code in complex or long functions; 14% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 23 |
| Duplication | 44 |
| Code smells (Opengrep) | 40 |
| Tests and CI | 100 |
| Documentation | 65 |
| Type safety | 0 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 3,063; mean complexity 5.5, 90th percentile 12; 230 complex and 79 long functions
- Duplicated lines: 13.8% of 46,679 compared
- Tests: 42,939 test lines for 60,120 source lines (ratio 0.71); CI test commands: make ci; 95% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- build_from_export in tools/build_ocr_cases_from_export.py: complexity 236, 879 lines
- toJSON in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 150, 1 lines
- n in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 127, 1 lines
- o.render in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 126, 1 lines
- it in .archive/quarantine/portfolio-2026-06-29/public/portfolio/assets/vendor-motion-CRw-feXK.js: complexity 125, 1 lines
Security
Security posture is adequate: 41 high-severity SAST findings; 17 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 85 |
| Static analysis (Opengrep) | 80 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | 2 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: security policy, dependency updates, signed commits, lockfiles; missing: none
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
.archive/quarantine/portfolio-2026-06-29/tools/build_portfolio_static.py:31 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:16 |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-audit: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low] |
main.py:40 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/eval_viz.py:690 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/eval_viz.py:831 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/evidence_sankey.py:100 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/evidence_sankey.py:102 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/manual_evals_surface.py:101 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/manual_evals_surface.py:156 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/manual_evals_surface.py:276 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/manual_evals_surface.py:309 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/manual_evals_surface.py:569 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/manual_evals_surface.py:856 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/api/manual_evals_surface.py:926 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/core/history_store.py:465 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/polinko/core/vector_store.py:268 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
tools/build_manual_evals_db.py:323 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
tools/build_manual_evals_db.py:350 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
tools/build_manual_evals_db.py:374 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
tools/build_manual_evals_db.py:400 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
tools/check_shell_scripts.py:132 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
tools/doctor_env.py:50 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
tools/doctor_env.py:183 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
tools/eval_ocr_batched.py:203 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
tools/eval_ocr_stability.py:313 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 60,120; test lines: 42,939
| Language | Lines |
|---|---|
| Python | 93,455 |
| JavaScript | 5,163 |
| Shell | 4,441 |