RepoTrust

Leaderboard github.com

ventz/moo-mac-terminal

Open-source native macOS terminal, up to 4× faster than Ghostty, with workspaces, notifications when Claude Code and other agents need you, herdr agents in the sidebar, Markdown and browser (ad-blocked) tabs, a ⌘K command palette, and a modern settings UI

  • View repository ↗
  • Swift
  • ★ 15
  • commit 9b01ba9ec1cc
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

explicit

Confidence
95%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

62/100

weak

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

78/100

adequate

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% explicit

Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.

How the score is built

  • Explicitly attributed share1%
  • Unattributed share in AI-pace bursts56%
  • Estimated AI-generated share1%
  • AI tool configuration files0
  • Work sessions at AI pace10
  • Releases at AI pace0
  • Coding-style index (1.0+ means possible)0.09

Attributed AI tools

ToolCommitsLines addedFirst seenLast seen
Claude Code33152026-09-232026-09-25

Lines added per month all AI-attributed share

  1. 2026-0821,909 · 0% AI
  2. 2026-0926,962 · 1% AI
  3. 2026-106,815 · 0% AI
  4. 2026-111,813 · 0% AI

Findings in AI-attributed lines vs the rest

From git blame: 307 lines trace to AI-attributed commits, 45,901 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 linesAI-attributedOtherRatio
Code quality0.004.36—
Security0.002.61—

Evidence by analyzer

Explicit AI attributionok4 items
attributed_commit_share
1.2%
attributed_commits
3
attributed_loc
315
attributed_loc_share
0.5%
commits
240
effective_loc
57,499
tools_detected
1
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok10 items
excluded_import_loc
9,553
flagged_loc
32,095
flagged_loc_share
66.9%
flagged_units
10
max_loc_per_hour
1,600.54
measured_loc
47,946
median_loc_per_hour
154.74
pr_timed_units
0
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
66
Release velocityok
flagged_releases
0
max_loc_per_day
6,768
releases
13
Coding styleok1 item
count:assistant_voice
0
count:emoji_in_code
6
count:narrated_steps
1
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
3
files:narrated_steps
1
files:placeholder
0
index
0.09
lines_scanned
45,691
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0.13
per_kloc:narrated_steps
0.02
per_kloc:placeholder
0
Findings in AI-written linesok
ai_lines
307
blame_failures
0
files_blamed
279
other_lines
45,901
quality:ai_findings
0
quality:ai_per_kloc
0
quality:other_findings
200
quality:other_per_kloc
4.36
security:ai_findings
0
security:ai_per_kloc
0
security:other_findings
120
security:other_per_kloc
2.61

Code quality

62 weak

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 9% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.

How the score is built

  • Complexity78
  • Duplication89
  • Lint and smells66
  • Tests and CI35
  • Documentation65
  • Type safety40
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items
complex_functions
414
function_nloc
43,305
functions
15,050
long_functions
15
many_param_functions
72
mean_ccn
3.22
p90_ccn
7
risky_nloc_share
8.5%
Duplication (jscpd)ok10 items
compared_lines
34,125
duplicated_lines
651
duplicated_share
1.9%
files
279
Lintok
category:correctness
237
category:maintainability
1
findings
238
scanned_lines
46,208
weighted_findings
76.75
Tests and CIok1 item
  • CI config: .github/workflows/build.yml .github/workflows/build.yml
check:ci_present
yes
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
yes
check:test_ratio
no
check:tests_cochange
no
ci_files
1
cochange_commits
180
cochange_share
0.6%
source_lines
46,208
test_lines
94
test_ratio
0.00
Documentationok2 items
  • README.md README.md
  • LICENSE LICENSE
check:changelog
no
check:contributing
no
check:license
yes
check:readme
yes
readme_lines
368
Type safetyok
check:low_escape_density
yes
check:strict_config
no
escapes
0
escapes_per_kloc
0

Security

78 adequate

Security posture is adequate: 6 known vulnerabilities in 2 dependencies; 17 high-severity SAST findings. Weakest area: posture.

How the score is built

  • Secrets100
  • Static analysis (SAST)75
  • Vulnerable dependencies77
  • CI workflows98
  • Security posture0
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
19
declared
19
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
120
findings_high
17
findings_low
4
findings_medium
99
parse_errors
59
scanned_lines
46,208
weighted_findings
37.75
Dependencies (osv-scanner)ok
penalty
16
vulnerabilities
6
vulnerable_packages
2
vulns_critical
1
vulns_high
1
vulns_low
2
vulns_medium
0
vulns_unknown
2
CI workflows (zizmor)ok
findings
1
findings_high
0
findings_low
0
findings_medium
1
penalty
1.20
workflows
1
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
no
signed_commit_share
0.0%
unpinned_manifests
0
Release downloadsok5 items
binary_assets
10
signals
1
suspicious
0

Findings

1 critical18 high125 medium183 low

SeverityRuleLocationMessageTool
critical osv/GHSA-cg2g-xh64-v4q7 tools/markdown-renderer/package-lock.json [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 Dependencies (osv-scanner)
high opengrep/javascript.browser.security.insecure-document-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 User controlled data in a `this.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 User controlled data in a `this.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.express.security.audit.remote-property-injection Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:2 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:2 User controlled data in a `ir.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:2 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:2 User controlled data in a `h.documentElement.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:4 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:4 User controlled data in a `e.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10 User controlled data in a `S.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10 User controlled data in a `c.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high osv/GHSA-mrv2-3pqr-j5jr tools/markdown-renderer/package-lock.json [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr Dependencies (osv-scanner)
high opengrep/javascript.browser.security.insecure-document-method tools/markdown-renderer/src/page.js:163 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml tools/markdown-renderer/src/page.js:163 User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:6 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VSXAHHWV-TQ3EUPE5.js:1 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VSXAHHWV-TQ3EUPE5.js:2 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-sankeyDiagram-P5KCCOFB-DQUAPPXJ.js:1 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/javascript.lang.correctness.no-replaceall Moo/MarkdownPreview/Resources/markdown-preview-chunk-sankeyDiagram-P5KCCOFB-DQUAPPXJ.js:1 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium opengrep/python.lang.maintainability.return-not-in-function scripts/compose-icon.py:74 `return` only makes sense inside a function Lint
medium opengrep/javascript.lang.correctness.no-replaceall tools/markdown-renderer/src/renderer.js:76 The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... Lint
medium zizmor/artipacked .github/workflows/build.yml:24 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:6 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5V6ZPB6O.js:1 RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:1 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:36 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:48 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:50 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:54 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:55 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:56 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:60 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:63 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:63 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:63 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:63 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:63 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:63 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:64 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:70 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:70 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:70 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:70 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:72 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:72 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-COYKZ2TO.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:251 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:251 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:251 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.incomplete-sanitization Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `r.envName.replace` method will only replace the first occurrence when used with a string argument ("*"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:256 Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:1 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:1 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:2 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:6 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JRGYRIQ5.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JTRA47S3.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:2 RegExp() called with a `i` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:4 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:4 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:5 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-MZS2HMNB.js:9 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:10 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:10 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:10 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:10 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:16 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:16 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-redos Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:20 Detected the use of a regular expression `^[-+]?[0-9_]+(?::[0-9_]+)+(?:\.[0-9_]*)?$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:9 Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:9 Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-S5E556QB.js:1 Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-S5E556QB.js:1 Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-S7CK7UJ4-B2UK6ENJ.js:3 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VSXAHHWV-TQ3EUPE5.js:1 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VSXAHHWV-TQ3EUPE5.js:2 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VSXAHHWV-TQ3EUPE5.js:2 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VSXAHHWV-TQ3EUPE5.js:2 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VX7I27RA-47BP2OQ7.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VX7I27RA-47BP2OQ7.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VX7I27RA-47BP2OQ7.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VX7I27RA-47BP2OQ7.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VX7I27RA-47BP2OQ7.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-VX7I27RA-47BP2OQ7.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:6 RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.jquery-insecure-selector Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:1 User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:1 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:8 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:8 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-sequenceDiagram-WJ2MYXX4-GPJLKBP5.js:149 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html Moo/MarkdownPreview/Resources/markdown-preview-chunk-sequenceDiagram-WJ2MYXX4-GPJLKBP5.js:162 JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] Static analysis (opengrep)
medium opengrep/bash.lang.security.ifs-tampering Moo/Profiles/Resources/shell-integration/bash/bash-preexec.sh:186 The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS... Static analysis (opengrep)
medium osv/GHSA-6688-9rhm-gjv2 tools/markdown-renderer/package-lock.json [email protected] (npm) is affected by GHSA-6688-9rhm-gjv2 Dependencies (osv-scanner)
medium osv/GHSA-c6gr-qvv4-5v3f tools/markdown-renderer/package-lock.json [email protected] (npm) is affected by GHSA-c6gr-qvv4-5v3f Dependencies (osv-scanner)
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-blockDiagram-I7D4REHJ-F2YS2VSV.js:129 `S` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-blockDiagram-I7D4REHJ-F2YS2VSV.js:30 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-blockDiagram-I7D4REHJ-F2YS2VSV.js:6 `l` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-blockDiagram-I7D4REHJ-F2YS2VSV.js:65 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:11 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 `v` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 `l` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 `y` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-c4Diagram-7LVT6UL2-3XDJCF3F.js:6 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:142 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:151 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:162 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:176 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:44 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:6 `_` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:6 `P` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:22 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:22 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:3 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:64 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:64 `p` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:64 `p` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:64 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:64 `p` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:71 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.eqeq-is-bad Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 Detected a useless comparison operation `r == r` or `r != r`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex. Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1 `f` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EQOBA53J.js:1 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-FEEPURGO.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-FEEPURGO.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:251 `v` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:251 `t` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `Y` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `p` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:257 `H1` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-J6724Z3I.js:81 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `o` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `o` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `d` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `l` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `l` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JHRLV6WV.js:1 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:110 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:178 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:22 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:6 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:60 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:78 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:9 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JRGYRIQ5.js:1 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JRGYRIQ5.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JRGYRIQ5.js:1 `o` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JRGYRIQ5.js:1 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JRGYRIQ5.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JTRA47S3.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:108 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:2 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:2 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:4 `B` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:43 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:5 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:72 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:8 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:85 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-MZS2HMNB.js:114 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-MZS2HMNB.js:146 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-MZS2HMNB.js:23 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-MZS2HMNB.js:41 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-MZS2HMNB.js:9 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-MZS2HMNB.js:9 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:1 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 `u` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 `R` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 `k` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 `nt` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 `G` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 `e` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 `R` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 `G` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 `G` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 `E` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:2 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:8 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-QJY5VU2O.js:1 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-R7NLEZGV.js:9 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-S5E556QB.js:1 `s` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-S5E556QB.js:1 `lr` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-S5E556QB.js:1 `i` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-WH7P6QC7.js:4 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-WH7P6QC7.js:4 `C` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-YU5QMQDN.js:1 `e.invalidProtocolRegex` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cose-bilkent-JH36ORCC-Z3IT4R64.js:1 `p` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cose-bilkent-JH36ORCC-Z3IT4R64.js:1 `A` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cose-bilkent-JH36ORCC-Z3IT4R64.js:1 `D` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cose-bilkent-JH36ORCC-Z3IT4R64.js:1 `h` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cose-bilkent-JH36ORCC-Z3IT4R64.js:1 `l` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cose-bilkent-JH36ORCC-Z3IT4R64.js:1 `c` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cose-bilkent-JH36ORCC-Z3IT4R64.js:1 `I` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-cynefinDiagram-5FMLGOSQ-3PS25KPK.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-cynefinDiagram-5FMLGOSQ-3PS25KPK.js:1 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-cynefinDiagram-5FMLGOSQ-3PS25KPK.js:1 `N` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-diagram-S7CK7UJ4-B2UK6ENJ.js:7 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-erDiagram-RLTQ6QDP-MFU7TI6X.js:27 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-erDiagram-RLTQ6QDP-MFU7TI6X.js:54 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-erDiagram-RLTQ6QDP-MFU7TI6X.js:6 `r` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:1 `p` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:1 `lt` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:103 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:12 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:237 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:6 `n` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:6 `a` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:6 `E` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:6 `E` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:6 `P` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:66 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-ganttDiagram-EL5Y4UJY-TTCWLE54.js:78 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.useless-assignment Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:13 `y` is assigned twice; the first assignment is useless Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:49 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:49 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:49 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:49 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:49 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:49 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:56 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:56 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-gitGraphDiagram-WWUBYQGX-HEKD6WHJ.js:86 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-ishikawaDiagram-5VMMS53U-OYWNQFIK.js:11 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-ishikawaDiagram-5VMMS53U-OYWNQFIK.js:39 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-journeyDiagram-3NMN7TZE-47762RO4.js:20 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-journeyDiagram-3NMN7TZE-47762RO4.js:41 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-journeyDiagram-3NMN7TZE-47762RO4.js:67 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-journeyDiagram-3NMN7TZE-47762RO4.js:8 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-kanban-definition-UXKFOSKX-QZBBJXR5.js:31 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-kanban-definition-UXKFOSKX-QZBBJXR5.js:57 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-kanban-definition-UXKFOSKX-QZBBJXR5.js:57 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-kanban-definition-UXKFOSKX-QZBBJXR5.js:66 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-kanban-definition-UXKFOSKX-QZBBJXR5.js:79 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-mindmap-definition-YA3MSWOX-BHXHTF3G.js:28 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.lang.correctness.missing-template-string-indicator Moo/MarkdownPreview/Resources/markdown-preview-chunk-mindmap-definition-YA3MSWOX-BHXHTF3G.js:54 This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? Lint
low opengrep/javascript.audit.detect-replaceall-sanitization Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:6 Detected a call to `replaceAll()` in an attempt to HTML escape the string `a`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such... Static analysis (opengrep)
low opengrep/javascript.audit.detect-replaceall-sanitization Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-JPG37FXM.js:6 Detected a call to `replaceAll()` in an attempt to HTML escape the string `a.replaceAll("<","&lt;")`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known... Static analysis (opengrep)
low opengrep/javascript.audit.detect-replaceall-sanitization Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 Detected a call to `replaceAll()` in an attempt to HTML escape the string `t`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such... Static analysis (opengrep)
low opengrep/javascript.audit.detect-replaceall-sanitization Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-PZLD6IP7.js:10 Detected a call to `replaceAll()` in an attempt to HTML escape the string `t.replaceAll("<","&lt;")`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known... Static analysis (opengrep)
low osv/GHSA-238p-pmpm-9mq7 tools/markdown-renderer/package-lock.json [email protected] (npm) is affected by GHSA-238p-pmpm-9mq7 Dependencies (osv-scanner)
low osv/GHSA-p98j-92pf-mc4p tools/markdown-renderer/package-lock.json [email protected] (npm) is affected by GHSA-p98j-92pf-mc4p Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceokprov-50
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-50
Findings in AI-written linesAI provenanceokgit-blame0
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b414200
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityokzizmor 1.32.01
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.16
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b414120
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-149b01ba9ec1ccprov-5+qual-2+sec-20%6278

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/ventz/moo-mac-terminal/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/ventz/moo-mac-terminal/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/ventz/moo-mac-terminal/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/ventz/moo-mac-terminal/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/ventz/moo-mac-terminal/security.svg)](https://repotrust.synapticcyber.com/r/github.com/ventz/moo-mac-terminal/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 explicit 95% 100%
Code quality 62 weak 90% 100%
Security 78 adequate 85% 100%

AI provenance

Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.

  • Explicitly attributed share (lower bound): 0.5%
  • Unattributed share in AI-consistent velocity bursts: 55.8%
  • Estimated AI-generated share: 0.5%
AI tool Attributed commits Lines added
Claude Code 3 315

Current source lines last changed by AI-attributed commits: 307 of 46,208.

Too few lines in one group to compare finding densities.

  • Stylometry index: 0.09 per 1,000 lines (narrated steps 1, placeholders 0, assistant phrasing 0, emoji 6). Reported as a signal, not scored.
Month Lines added Attributed to AI
2026-08 21,909 0%
2026-09 26,962 1%
2026-10 6,815 0%
2026-11 1,813 0%

Evidence

  • Claude Code: trailer 'Co-Authored-By: Claude' (4fe1a80246ea)
  • Claude Code: trailer 'Co-Authored-By: Claude' (738d62123a39)
  • Claude Code: trailer 'Co-Authored-By: Claude' (bb4ae0b32f01)
  • 4,586 lines of first-party code in ~2.9h (1,601 lines/hour, 6 commit session) (a7fc1e9dd4b3)
  • 1,045 lines of first-party code in ~0.8h (1,338 lines/hour, 1 commit session) (128e4af08e8e)
  • 3,704 lines of first-party code in ~4.1h (895 lines/hour, 16 commit session) (499b328a38a3)
  • 3,437 lines of first-party code in ~4.0h (859 lines/hour, 1 commit session) (cf161d45c8c7)
  • 3,270 lines of first-party code in ~4.0h (818 lines/hour, 8 commit session) (5cf9b1e0ed12)
  • 3,156 lines of first-party code in ~4.0h (789 lines/hour, 1 commit session) (9b78546fb60b)
  • 3,840 lines of first-party code in ~6.0h (640 lines/hour, 9 commit session) (a4ec07d46475)
  • 3,952 lines of first-party code in ~6.7h (591 lines/hour, 10 commit session) (a7a352aeed01)
  • 2,431 lines of first-party code in ~4.2h (581 lines/hour, 6 commit session) (5bdc92b0f8d8)
  • 2,674 lines of first-party code in ~4.9h (543 lines/hour, 6 commit session) (32a4cbc4277a)
  • step-by-step narration comment: // first, leaving it an empty frame. These pin the behavior that fixed it. (MooTests/Wor)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 9% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.

Area Score
Complexity (lizard) 78
Duplication 89
Code smells (Opengrep) 66
Tests and CI 35
Documentation 65
Type safety 40
Process (Scorecard review/maintenance) n/a
  • Functions: 15,050; mean complexity 3.2, 90th percentile 7; 414 complex and 15 long functions
  • Duplicated lines: 1.9% of 34,125 compared
  • Tests: 94 test lines for 46,208 source lines (ratio 0.00); CI test commands: none detected; 1% of recent source commits also change tests
  • Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 6 known vulnerabilities in 2 dependencies; 17 high-severity SAST findings. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 75
Vulnerable dependencies (OSV) 77
CI workflows (zizmor) 98
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a

  • Known vulnerabilities: 6 in 2 packages (critical 1, high 1, medium 0, low 2)

  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
critical osv/GHSA-cg2g-xh64-v4q7: [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7 tools/markdown-renderer/package-lock.json
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a this.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a this.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-EDLQSWET.js:1
high opengrep/javascript.express.security.audit.remote-property-injection: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-G6KSIPDO.js:252
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:2
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a ir.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-IIRUCTOO.js:2
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:2
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a h.documentElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:2
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:4
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a e.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-M5VK266L.js:4
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a S.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a c.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-mermaid.core-62FPEFXZ.js:10
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] tools/markdown-renderer/src/page.js:163
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a content.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] tools/markdown-renderer/src/page.js:163
high osv/GHSA-mrv2-3pqr-j5jr: [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr tools/markdown-renderer/package-lock.json
medium opengrep/javascript.jquery.security.audit.prohibit-jquery-html: JQuery's html function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider text instead. Otherwise, use a function that escapes HTML such as edX's HtmlUtils.setHtml(). [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5EQ7CHDT.js:6
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a e function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-5V6ZPB6O.js:1
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:1
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a r function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:1
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a e function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6
medium opengrep/javascript.lang.security.audit.detect-non-literal-regexp: RegExp() called with a r function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low] Moo/MarkdownPreview/Resources/markdown-preview-chunk-chunk-66QDC5M3.js:6

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

  • Source lines: 46,208; test lines: 94
Language Lines
Swift 39,917
JavaScript 4,237
Shell 1,774
Python 374